Merge lp:~chrisccoulson/nss/nss-3.12.5 into lp:~mozillateam/nss/nss.head

[Chris Coulson]

[lp:~chrisccoulson/nss/nss-3.12.5]

106. By Alexander Sack on 2010-03-30

(merge lp:~chrisccoulson/nss/nss-3.12.5)
* New upstream release 3.12.6 RTM (NSS_3_12_6_RTM)
  - fixes CVE-2009-3555 aka US-CERT VU#120541
* Adjust patches to changed upstream code base
  - update debian/patches/38_kbsd.patch
  - update debian/patches/38_mips64_build.patch
  - update debian/patches/85_security_load.patch
* Remove patches that are merged upstream
  - delete debian/patches/91_nonexec_stack.patch
  - update debian/patches/series
* Bump nspr dependency to 4.8
  - update debian/control
* Add new symbols for 3.12.6
  - update debian/libnss3-1d.symbols
* rebuild rest of main for armel armv7/thumb2 optimization;
  UbuntuSpec:mobile-lucid-arm-gcc-v7-thumb2
* Add 91_nonexec_stack.patch: fix regression in stack memory
  protectons caused by unmarked assembly (LP: #409864).

=== modified file 'debian/changelog'
--- debian/changelog	2009-08-01 15:06:02 +0000
+++ debian/changelog	2010-03-29 11:55:44 +0000
@@ -1,3 +1,34 @@
+nss (3.12.6-0ubuntu1) UNRELEASED; urgency=low
+
+  * New upstream release 3.12.6 RTM (NSS_3_12_6_RTM)
+  * Adjust patches to changed upstream code base
+    - update debian/patches/38_kbsd.patch
+    - update debian/patches/38_mips64_build.patch
+    - update debian/patches/85_security_load.patch
+  * Remove patches that are merged upstream
+    - delete debian/patches/91_nonexec_stack.patch
+    - update debian/patches/series
+  * Bump nspr dependency to 4.8
+    - update debian/control
+  * Add new symbols for 3.12.6
+    - update debian/libnss3-1d.symbols
+
+ -- Chris Coulson <[e-mail]>  Thu, 25 Mar 2010 13:46:06 +0000
+
+nss (3.12.3.1-0ubuntu3) lucid; urgency=low
+
+  * rebuild rest of main for armel armv7/thumb2 optimization;
+    UbuntuSpec:mobile-lucid-arm-gcc-v7-thumb2
+
+ -- Alexander Sack <[e-mail]>  Sun, 07 Mar 2010 00:58:36 +0100
+
+nss (3.12.3.1-0ubuntu2) karmic; urgency=low
+
+  * Add 91_nonexec_stack.patch: fix regression in stack memory
+    protectons caused by unmarked assembly (LP: #409864).
+
+ -- Kees Cook <[e-mail]>  Mon, 24 Aug 2009 15:03:19 -0700
+
 nss (3.12.3.1-0ubuntu1) karmic; urgency=low
 
   * new upstream release 3.12.3.1 RTM (NSS_3_12_3_1_RTM) (LP: #407549)

=== modified file 'debian/control'
--- debian/control	2009-06-16 11:16:54 +0000
+++ debian/control	2010-03-29 11:55:44 +0000
@@ -3,7 +3,7 @@
 Priority: optional
 Maintainer: Ubuntu Mozilla Team <[e-mail]>
 XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
-Build-Depends: debhelper (>= 5.0.0), autotools-dev, quilt (>= 0.40), dpkg-dev (>= 1.13.19), libnspr4-dev (>= 4.7.4), zlib1g-dev, libsqlite3-dev (>= 3.3.17)
+Build-Depends: debhelper (>= 5.0.0), autotools-dev, quilt (>= 0.40), dpkg-dev (>= 1.13.19), libnspr4-dev (>= 4.8), zlib1g-dev, libsqlite3-dev (>= 3.3.17)
 Standards-Version: 3.7.3
 Homepage: http://www.mozilla.org/projects/security/pki/nss/
 

=== modified file 'debian/libnss3-1d.symbols'
--- debian/libnss3-1d.symbols	2009-06-16 11:23:38 +0000
+++ debian/libnss3-1d.symbols	2010-03-29 11:55:44 +0000
@@ -3,6 +3,7 @@
  ATOB_ConvertAsciiToItem@NSS_3.2 3.12.2~rc1
  BTOA_ConvertItemToAscii@NSS_3.2 3.12.2~rc1
  BTOA_DataToAscii@NSS_3.2 3.12.2~rc1
+ CERT_AddCertToListSorted@NSS_3.12.5 3.12.5
  CERT_AddCertToListTail@NSS_3.2 3.12.2~rc1
  CERT_AddExtension@NSS_3.5 3.12.2~rc1
  CERT_AddOCSPAcceptableResponses@NSS_3.6 3.12.2~rc1
@@ -11,6 +12,7 @@
  CERT_AsciiToName@NSS_3.2 3.12.2~rc1
  CERT_CRLCacheRefreshIssuer@NSS_3.7 3.12.2~rc1
  CERT_CacheCRL@NSS_3.10 3.12.2~rc1
+ CERT_CacheOCSPResponseFromSideChannel@NSS_3.12.6 3.12.6
  CERT_CertChainFromCert@NSS_3.2 3.12.2~rc1
  CERT_CertListFromCert@NSS_3.2 3.12.2~rc1
  CERT_CertTimesValid@NSS_3.2 3.12.2~rc1
@@ -69,8 +71,10 @@
  CERT_DestroyValidity@NSS_3.5 3.12.2~rc1
  CERT_DisableOCSPChecking@NSS_3.3 3.12.2~rc1
  CERT_DisableOCSPDefaultResponder@NSS_3.3 3.12.2~rc1
+ CERT_DistNamesFromCertList@NSS_3.12.6 3.12.6
  CERT_DupCertList@NSS_3.2 3.12.2~rc1
  CERT_DupCertificate@NSS_3.2 3.12.2~rc1
+ CERT_DupDistNames@NSS_3.12.6 3.12.6
  CERT_EnableOCSPChecking@NSS_3.2 3.12.2~rc1
  CERT_EnableOCSPDefaultResponder@NSS_3.3 3.12.2~rc1
  CERT_EncodeAltNameExtension@NSS_3.7 3.12.2~rc1
@@ -260,6 +264,9 @@
  NSS_3.11@NSS_3.11 3.12.2~rc1
  NSS_3.12.1@NSS_3.12.1 3.12.2~rc1
  NSS_3.12.3@NSS_3.12.3 3.12.3
+ NSS_3.12.4@NSS_3.12.4 3.12.5
+ NSS_3.12.5@NSS_3.12.5 3.12.5
+ NSS_3.12.6@NSS_3.12.6 3.12.6
  NSS_3.12@NSS_3.12 3.12.2~rc1
  NSS_3.2.1@NSS_3.2.1 3.12.2~rc1
  NSS_3.2@NSS_3.2 3.12.2~rc1
@@ -310,6 +317,7 @@
  NSS_Get_SEC_UTF8StringTemplate@NSS_3.4 3.12.2~rc1
  NSS_Get_sgn_DigestInfoTemplate@NSS_3.2 3.12.2~rc1
  NSS_Init@NSS_3.2 3.12.2~rc1
+ NSS_InitContext@NSS_3.12.5 3.12.5
  NSS_InitReadWrite@NSS_3.2 3.12.2~rc1
  NSS_InitWithMerge@NSS_3.12 3.12.2~rc1
  NSS_Initialize@NSS_3.2 3.12.2~rc1
@@ -318,6 +326,7 @@
  NSS_PutEnv@NSS_3.2 3.12.2~rc1
  NSS_RegisterShutdown@NSS_3.11.1 3.12.2~rc1
  NSS_Shutdown@NSS_3.2 3.12.2~rc1
+ NSS_ShutdownContext@NSS_3.12.5 3.12.5
  NSS_UnregisterShutdown@NSS_3.11.1 3.12.2~rc1
  NSS_VersionCheck@NSS_3.2 3.12.2~rc1
  PBE_CreateContext@NSS_3.3 3.12.2~rc1
@@ -477,6 +486,7 @@
  PK11_IsFriendly@NSS_3.2 3.12.2~rc1
  PK11_IsHW@NSS_3.2 3.12.2~rc1
  PK11_IsInternal@NSS_3.2 3.12.2~rc1
+ PK11_IsInternalKeySlot@NSS_3.12.4 3.12.5
  PK11_IsLoggedIn@NSS_3.3 3.12.2~rc1
  PK11_IsPresent@NSS_3.2 3.12.2~rc1
  PK11_IsReadOnly@NSS_3.2 3.12.2~rc1
@@ -662,17 +672,20 @@
  SECMOD_FreeModuleSpecList@NSS_3.4 3.12.2~rc1
  SECMOD_GetDBModuleList@NSS_3.9 3.12.2~rc1
  SECMOD_GetDeadModuleList@NSS_3.9 3.12.2~rc1
+ SECMOD_GetDefaultModDBFlag@NSS_3.12.5 3.12.5
  SECMOD_GetDefaultModuleList@NSS_3.3 3.12.2~rc1
  SECMOD_GetDefaultModuleListLock@NSS_3.3 3.12.2~rc1
  SECMOD_GetInternalModule@NSS_3.3 3.12.2~rc1
  SECMOD_GetModuleSpecList@NSS_3.4 3.12.2~rc1
  SECMOD_GetReadLock@NSS_3.3 3.12.2~rc1
+ SECMOD_GetSkipFirstFlag@NSS_3.12.5 3.12.5
  SECMOD_HasRemovableSlots@NSS_3.9.3 3.12.2~rc1
  SECMOD_HasRootCerts@NSS_3.11 3.12.2~rc1
  SECMOD_IsModulePresent@NSS_3.2 3.12.2~rc1
  SECMOD_LoadModule@NSS_3.4 3.12.2~rc1
  SECMOD_LoadUserModule@NSS_3.4 3.12.2~rc1
  SECMOD_LookupSlot@NSS_3.2 3.12.2~rc1
+ SECMOD_OpenNewSlot@NSS_3.12.4 3.12.5
  SECMOD_OpenUserDB@NSS_3.11 3.12.2~rc1
  SECMOD_PubCipherFlagstoInternal@NSS_3.4 3.12.2~rc1
  SECMOD_PubMechFlagstoInternal@NSS_3.4 3.12.2~rc1
@@ -835,6 +848,7 @@
  NSSRWLock_UnlockRead_Util@NSSUTIL_3.12 3.12.2~rc1
  NSSRWLock_UnlockWrite_Util@NSSUTIL_3.12 3.12.2~rc1
  NSSUTIL_3.12.3@NSSUTIL_3.12.3 3.12.3
+ NSSUTIL_3.12.5@NSSUTIL_3.12.5 3.12.5
  NSSUTIL_3.12@NSSUTIL_3.12 3.12.2~rc1
  NSS_GetAlgorithmPolicy@NSSUTIL_3.12.3 3.12.3
  NSS_Get_SECOID_AlgorithmIDTemplate_Util@NSSUTIL_3.12 3.12.2~rc1
@@ -863,6 +877,7 @@
  NSS_Get_SEC_UniversalStringTemplate@NSSUTIL_3.12 3.12.2~rc1
  NSS_Get_sgn_DigestInfoTemplate_Util@NSSUTIL_3.12 3.12.2~rc1
  NSS_PutEnv_Util@NSSUTIL_3.12 3.12.2~rc1
+ NSS_SecureMemcmp@NSSUTIL_3.12.5 3.12.5
  NSS_SetAlgorithmPolicy@NSSUTIL_3.12.3 3.12.3
  PORT_Alloc_Util@NSSUTIL_3.12 3.12.2~rc1
  PORT_ArenaAlloc_Util@NSSUTIL_3.12 3.12.2~rc1
@@ -876,6 +891,7 @@
  PORT_Free_Util@NSSUTIL_3.12 3.12.2~rc1
  PORT_GetError_Util@NSSUTIL_3.12 3.12.2~rc1
  PORT_ISO88591_UTF8Conversion@NSSUTIL_3.12 3.12.2~rc1
+ PORT_LoadLibraryFromOrigin@NSSUTIL_3.12.5 3.12.5
  PORT_NewArena_Util@NSSUTIL_3.12 3.12.2~rc1
  PORT_Realloc_Util@NSSUTIL_3.12 3.12.2~rc1
  PORT_RegExpCaseSearch@NSSUTIL_3.12 3.12.2~rc1
@@ -1150,6 +1166,7 @@
  NSSSSL_VersionCheck@NSS_3.2.1 3.12.2~rc1
  NSS_3.11.4@NSS_3.11.4 3.12.2~rc1
  NSS_3.11.8@NSS_3.11.8 3.12.2~rc1
+ NSS_3.12.6@NSS_3.12.6 3.12.6
  NSS_3.2.1@NSS_3.2.1 3.12.2~rc1
  NSS_3.2@NSS_3.2 3.12.2~rc1
  NSS_3.4@NSS_3.4 3.12.2~rc1
@@ -1175,16 +1192,21 @@
  SSL_ConfigMPServerSIDCache@NSS_3.2 3.12.2~rc1
  SSL_ConfigSecureServer@NSS_3.2 3.12.2~rc1
  SSL_ConfigServerSessionIDCache@NSS_3.2 3.12.2~rc1
+ SSL_ConfigServerSessionIDCacheWithOpt@NSS_3.12.6 3.12.6
  SSL_DataPending@NSS_3.2 3.12.2~rc1
  SSL_ForceHandshake@NSS_3.2 3.12.2~rc1
  SSL_ForceHandshakeWithTimeout@NSS_3.11.4 3.12.2~rc1
  SSL_GetChannelInfo@NSS_3.4 3.12.2~rc1
  SSL_GetCipherSuiteInfo@NSS_3.4 3.12.2~rc1
  SSL_GetClientAuthDataHook@NSS_3.2 3.12.2~rc1
+ SSL_GetImplementedCiphers@NSS_3.12.6 3.12.6
  SSL_GetMaxServerCacheLocks@NSS_3.4 3.12.2~rc1
+ SSL_GetNegotiatedHostInfo@NSS_3.12.6 3.12.6
+ SSL_GetNumImplementedCiphers@NSS_3.12.6 3.12.6
  SSL_GetSessionID@NSS_3.2 3.12.2~rc1
  SSL_GetStatistics@NSS_3.2 3.12.2~rc1
  SSL_HandshakeCallback@NSS_3.2 3.12.2~rc1
+ SSL_HandshakeNegotiatedExtension@NSS_3.12.6 3.12.6
  SSL_ImplementedCiphers@NSS_3.2 3.12.2~rc1
  SSL_ImportFD@NSS_3.2 3.12.2~rc1
  SSL_InheritMPServerSIDCache@NSS_3.2 3.12.2~rc1
@@ -1200,15 +1222,18 @@
  SSL_PreencryptedStreamToFile@NSS_3.2 3.12.2~rc1
  SSL_ReHandshake@NSS_3.2 3.12.2~rc1
  SSL_ReHandshakeWithTimeout@NSS_3.11.4 3.12.2~rc1
+ SSL_ReconfigFD@NSS_3.12.6 3.12.6
  SSL_ResetHandshake@NSS_3.2 3.12.2~rc1
  SSL_RestartHandshakeAfterCertReq@NSS_3.2 3.12.2~rc1
  SSL_RestartHandshakeAfterServerCert@NSS_3.2 3.12.2~rc1
  SSL_RevealCert@NSS_3.2 3.12.2~rc1
  SSL_RevealPinArg@NSS_3.2 3.12.2~rc1
  SSL_RevealURL@NSS_3.2 3.12.2~rc1
+ SSL_SNISocketConfigHook@NSS_3.12.6 3.12.6
  SSL_SecurityStatus@NSS_3.2 3.12.2~rc1
  SSL_SetMaxServerCacheLocks@NSS_3.4 3.12.2~rc1
  SSL_SetPKCS11PinArg@NSS_3.2 3.12.2~rc1
  SSL_SetSockPeerID@NSS_3.2 3.12.2~rc1
+ SSL_SetTrustAnchors@NSS_3.12.6 3.12.6
  SSL_SetURL@NSS_3.2 3.12.2~rc1
  SSL_ShutdownServerSessionIDCache@NSS_3.7.4 3.12.2~rc1

=== modified file 'debian/patches/38_kbsd.patch'
--- debian/patches/38_kbsd.patch	2009-04-29 14:33:57 +0000
+++ debian/patches/38_kbsd.patch	2010-03-29 11:55:44 +0000
@@ -1,23 +1,18 @@
 ---
- mozilla/security/coreconf/Linux.mk          |   71 ++++++----------------------
- mozilla/security/coreconf/Linux2.6.mk       |    3 +
- mozilla/security/coreconf/arch.mk           |    8 +++
- mozilla/security/coreconf/config.mk         |    2 
- mozilla/security/nss/lib/freebl/unix_rand.c |    2 
- mozilla/security/nss/lib/ssl/sslmutex.c     |    2 
- mozilla/security/nss/lib/ssl/sslmutex.h     |    2 
- 7 files changed, 32 insertions(+), 58 deletions(-)
+ coreconf/Linux.mk          |   34 +++++++++++++++++-----------------
+ coreconf/Linux2.6.mk       |    3 +++
+ coreconf/arch.mk           |    8 ++++++++
+ coreconf/config.mk         |    2 +-
+ nss/lib/freebl/unix_rand.c |    2 ++
+ nss/lib/ssl/sslmutex.c     |    2 +-
+ nss/lib/ssl/sslmutex.h     |    2 +-
+ 7 files changed, 33 insertions(+), 20 deletions(-)
 
-Index: nss-3.12.3/mozilla/security/nss/lib/freebl/unix_rand.c
+Index: nss-3.12.6/mozilla/security/nss/lib/freebl/unix_rand.c
 ===================================================================
---- nss-3.12.3.orig/mozilla/security/nss/lib/freebl/unix_rand.c
-+++ nss-3.12.3/mozilla/security/nss/lib/freebl/unix_rand.c
-@@ -183,16 +183,18 @@
-     }
-     return rv;
- }
- 
- #endif
+--- nss-3.12.6.orig/mozilla/security/nss/lib/freebl/unix_rand.c	2010-03-25 13:48:26.593065793 +0000
++++ nss-3.12.6/mozilla/security/nss/lib/freebl/unix_rand.c	2010-03-25 13:48:26.623067512 +0000
+@@ -188,6 +188,8 @@
  
  #if defined(SCO) || defined(UNIXWARE) || defined(BSDI) || defined(FREEBSD) \
      || defined(NETBSD) || defined(DARWIN) || defined(OPENBSD) \
@@ -26,198 +21,121 @@
      || defined(NTO) || defined(__riscos__)
  #include <sys/times.h>
  
- #define getdtablesize() sysconf(_SC_OPEN_MAX)
+Index: nss-3.12.6/mozilla/security/coreconf/arch.mk
+===================================================================
+--- nss-3.12.6.orig/mozilla/security/coreconf/arch.mk	2009-06-05 03:14:49.000000000 +0100
++++ nss-3.12.6/mozilla/security/coreconf/arch.mk	2010-03-25 13:48:26.623067512 +0000
+@@ -155,6 +155,14 @@
+     ifneq ($(words $(OS_RELEASE)),1)
+ 	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
+     endif
++    KERNEL = linux
++endif
++
++# This check must be last.  Since all uses of OS_ARCH that follow affect only
++# userland, we can merge other Glibc systems with Linux here.
++ifneq (, $(filter GNU GNU_%, $(OS_ARCH)))
++OS_ARCH = Linux
++OS_RELEASE = 2.6
+ endif
  
- static size_t
- GetHighResClock(void *buf, size_t maxbytes)
- {
-Index: nss-3.12.3/mozilla/security/nss/lib/ssl/sslmutex.c
+ #
+Index: nss-3.12.6/mozilla/security/nss/lib/ssl/sslmutex.c
 ===================================================================
---- nss-3.12.3.orig/mozilla/security/nss/lib/ssl/sslmutex.c
-+++ nss-3.12.3/mozilla/security/nss/lib/ssl/sslmutex.c
-@@ -84,17 +84,17 @@
-     if (!pMutex->u.sslLock) {
-         PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
-         return SECFailure;
-     }
-     PR_Lock(pMutex->u.sslLock);
+--- nss-3.12.6.orig/mozilla/security/nss/lib/ssl/sslmutex.c	2009-06-05 03:34:14.000000000 +0100
++++ nss-3.12.6/mozilla/security/nss/lib/ssl/sslmutex.c	2010-03-25 13:48:26.623067512 +0000
+@@ -89,7 +89,7 @@
      return SECSuccess;
  }
  
--#if defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD)
-+#if defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) || defined(__GLIBC__)
+-#if defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD)
++#if defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) || defined(__GLIBC__)
  
  #include <unistd.h>
  #include <fcntl.h>
- #include <string.h>
- #include <errno.h>
- #include "unix_err.h"
- #include "pratom.h"
- 
-Index: nss-3.12.3/mozilla/security/nss/lib/ssl/sslmutex.h
+Index: nss-3.12.6/mozilla/security/nss/lib/ssl/sslmutex.h
 ===================================================================
---- nss-3.12.3.orig/mozilla/security/nss/lib/ssl/sslmutex.h
-+++ nss-3.12.3/mozilla/security/nss/lib/ssl/sslmutex.h
-@@ -78,17 +78,17 @@
- #endif
-         PRLock* sslLock;
-         HANDLE sslMutx;
-     } u;
- } sslMutex;
+--- nss-3.12.6.orig/mozilla/security/nss/lib/ssl/sslmutex.h	2009-06-05 03:34:15.000000000 +0100
++++ nss-3.12.6/mozilla/security/nss/lib/ssl/sslmutex.h	2010-03-25 13:48:26.623067512 +0000
+@@ -83,7 +83,7 @@
  
  typedef int    sslPID;
  
--#elif defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD)
-+#elif defined(LINUX) || defined(AIX) || defined(VMS) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) || defined(__GLIBC__)
+-#elif defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD)
++#elif defined(LINUX) || defined(AIX) || defined(BEOS) || defined(BSDI) || (defined(NETBSD) && __NetBSD_Version__ < 500000000) || defined(OPENBSD) || defined(__GLIBC__)
  
  #include <sys/types.h>
  #include "prtypes.h"
- 
- typedef struct { 
-     PRBool isMultiProcess;
-     union {
-         PRLock* sslLock;
-Index: nss-3.12.3/mozilla/security/coreconf/Linux.mk
+Index: nss-3.12.6/mozilla/security/coreconf/Linux.mk
 ===================================================================
---- nss-3.12.3.orig/mozilla/security/coreconf/Linux.mk
-+++ nss-3.12.3/mozilla/security/coreconf/Linux.mk
-@@ -47,107 +47,70 @@
- endif
- 
- CC			= gcc
- CCC			= g++
- RANLIB			= ranlib
+--- nss-3.12.6.orig/mozilla/security/coreconf/Linux.mk	2010-01-15 22:19:00.000000000 +0000
++++ nss-3.12.6/mozilla/security/coreconf/Linux.mk	2010-03-25 13:54:10.280567769 +0000
+@@ -52,6 +52,16 @@
  
  DEFAULT_COMPILER = gcc
  
--ifeq ($(OS_TEST),m68k)
--	OS_REL_CFLAGS	= -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH	= m68k
 +CPU_ARCH		= $(OS_TEST)
 +
 +ifeq ($(KERNEL),linux)
 +	OS_REL_CFLAGS	= -D_XOPEN_SOURCE -DLINUX1_2
 +	ARCH		= linux
- else
++else
 +	OS_REL_CFLAGS	= -D_XOPEN_SOURCE
 +	ARCH		= gnu
 +endif
 +
  ifeq ($(OS_TEST),ppc64)
--	OS_REL_CFLAGS	= -DLINUX1_2 -D_XOPEN_SOURCE
  	CPU_ARCH	= ppc
  ifeq ($(USE_64),1)
- 	ARCHFLAG	= -m64
+@@ -59,14 +69,11 @@
  endif
  else
--ifeq ($(OS_TEST),ppc)
--	OS_REL_CFLAGS	= -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH	= ppc
--else
  ifeq ($(OS_TEST),alpha)
--        OS_REL_CFLAGS   = -D_ALPHA_ -DLINUX1_2 -D_XOPEN_SOURCE
+-        OS_REL_CFLAGS   = -D_ALPHA_
 -	CPU_ARCH	= alpha
--else
--ifeq ($(OS_TEST),ia64)
--	OS_REL_CFLAGS	= -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH	= ia64
-+	OS_REL_CFLAGS	+= -D_ALPHA_
++        OS_REL_CFLAGS	+= -D_ALPHA_
  else
  ifeq ($(OS_TEST),x86_64)
 -ifeq ($(USE_64),1)
--	OS_REL_CFLAGS	= -DLINUX1_2 -D_XOPEN_SOURCE
 -	CPU_ARCH	= x86_64
 -else
--	OS_REL_CFLAGS	= -DLINUX1_2 -Di386 -D_XOPEN_SOURCE
+-	OS_REL_CFLAGS	= -Di386
 +ifneq ($(USE_64),1)
 +	OS_REL_CFLAGS	+= -Di386
  	CPU_ARCH	= x86
  	ARCHFLAG	= -m32
  endif
- else
--ifeq ($(OS_TEST),sparc)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH        = sparc
--else
- ifeq ($(OS_TEST),sparc64)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
- 	CPU_ARCH        = sparc
- else
- ifeq (,$(filter-out arm% sa110,$(OS_TEST)))
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
- 	CPU_ARCH        = arm
- else
- ifeq ($(OS_TEST),parisc)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
- 	CPU_ARCH        = hppa
- else
- ifeq ($(OS_TEST),parisc64)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
- 	CPU_ARCH        = hppa
- else
--ifeq ($(OS_TEST),s390)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH        = s390
--else
--ifeq ($(OS_TEST),s390x)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH        = s390x
--else
--ifeq ($(OS_TEST),mips)
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH        = mips
--else
+@@ -80,8 +87,8 @@
+ ifeq (,$(filter-out parisc%,$(OS_TEST)))
+ 	CPU_ARCH        = hppa
+ else
 -ifeq (,$(filter-out i%86,$(OS_TEST)))
--	OS_REL_CFLAGS	= -DLINUX1_2 -Di386 -D_XOPEN_SOURCE
+-	OS_REL_CFLAGS	= -Di386
 +ifeq (,$(filter-out i686 i586 i486 i386,$(OS_TEST)))
 +	OS_REL_CFLAGS	+= -Di386
  	CPU_ARCH	= x86
--else
--	OS_REL_CFLAGS   = -DLINUX1_2 -D_XOPEN_SOURCE
--	CPU_ARCH	= $(OS_TEST)
--endif
--endif
--endif
--endif
--endif
--endif
--endif
- endif
- endif
- endif
- endif
- endif
- endif
- endif
- endif
- 
+ else
+ ifeq ($(OS_TEST),sh4a)
+@@ -101,7 +108,7 @@
  
  LIBC_TAG		= _glibc
  
 -ifeq ($(OS_RELEASE),2.0)
 +ifeq ($(KERNEL)-$(OS_RELEASE),linux-2.0)
  	OS_REL_CFLAGS	+= -DLINUX2_0
- 	MKSHLIB		= $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so)
+ 	MKSHLIB		= $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
  	ifdef MAPFILE
- 		MKSHLIB += -Wl,--version-script,$(MAPFILE)
- 	endif
- 	PROCESS_MAP_FILE = grep -v ';-' $< | \
-          sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
- endif
-@@ -166,24 +129,22 @@
- 
- OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -ansi -Wall -Werror-implicit-function-declaration -Wno-switch -pipe -DLINUX -Dlinux -D_POSIX_SOURCE -D_BSD_SOURCE -DHAVE_STRERROR
- OS_LIBS			= $(OS_PTHREAD) -ldl -lc
- 
- ifdef USE_PTHREADS
+@@ -139,8 +146,6 @@
  	DEFINES		+= -D_REENTRANT
  endif
  
 -ARCH			= linux
 -
  DSO_CFLAGS		= -fPIC
- DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,-z,defs
- DSO_LDFLAGS		=
+ DSO_LDOPTS		= -shared $(ARCHFLAG)
+ # The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
+@@ -150,7 +155,7 @@
+ DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
  LDFLAGS			+= $(ARCHFLAG)
  
 -# INCLUDES += -I/usr/include -Y/usr/include/linux
@@ -225,21 +143,11 @@
  G++INCLUDES		= -I/usr/include/g++
  
  #
- # Always set CPU_TAG on Linux, OpenVMS, WINCE.
- #
- CPU_TAG = _$(CPU_ARCH)
- 
- USE_SYSTEM_ZLIB = 1
-Index: nss-3.12.3/mozilla/security/coreconf/Linux2.6.mk
+Index: nss-3.12.6/mozilla/security/coreconf/Linux2.6.mk
 ===================================================================
---- nss-3.12.3.orig/mozilla/security/coreconf/Linux2.6.mk
-+++ nss-3.12.3/mozilla/security/coreconf/Linux2.6.mk
-@@ -32,17 +32,20 @@
- # and other provisions required by the GPL or the LGPL. If you do not delete
- # the provisions above, a recipient may use your version of this file under
- # the terms of any one of the MPL, the GPL or the LGPL.
- #
- # ***** END LICENSE BLOCK *****
+--- nss-3.12.6.orig/mozilla/security/coreconf/Linux2.6.mk	2009-06-11 01:55:32.000000000 +0100
++++ nss-3.12.6/mozilla/security/coreconf/Linux2.6.mk	2010-03-25 13:48:26.623067512 +0000
+@@ -37,7 +37,10 @@
  
  include $(CORE_DEPTH)/coreconf/Linux.mk
  
@@ -247,63 +155,19 @@
  OS_REL_CFLAGS   += -DLINUX2_1
 +endif
 +
- MKSHLIB         = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so)
+ MKSHLIB         = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
  
  ifdef MAPFILE
- 	MKSHLIB += -Wl,--version-script,$(MAPFILE)
- endif
- PROCESS_MAP_FILE = grep -v ';-' $< | \
-         sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
- 
-Index: nss-3.12.3/mozilla/security/coreconf/arch.mk
-===================================================================
---- nss-3.12.3.orig/mozilla/security/coreconf/arch.mk
-+++ nss-3.12.3/mozilla/security/coreconf/arch.mk
-@@ -150,16 +150,24 @@
-     OS_RELEASE := $(shell echo $(OS_RELEASE) | sed 's/-.*//')
- endif
- 
- ifeq ($(OS_ARCH),Linux)
-     OS_RELEASE := $(subst ., ,$(OS_RELEASE))
-     ifneq ($(words $(OS_RELEASE)),1)
- 	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
-     endif
-+    KERNEL = linux
-+endif
-+
-+# This check must be last.  Since all uses of OS_ARCH that follow affect only
-+# userland, we can merge other Glibc systems with Linux here.
-+ifneq (, $(filter GNU GNU_%, $(OS_ARCH)))
-+OS_ARCH = Linux
-+OS_RELEASE = 2.6
- endif
- 
- #
- # For OS/2
- #
- ifeq ($(OS_ARCH),OS_2)
-     OS_ARCH = OS2
-     OS_RELEASE := $(shell uname -v)
-Index: nss-3.12.3/mozilla/security/coreconf/config.mk
-===================================================================
---- nss-3.12.3.orig/mozilla/security/coreconf/config.mk
-+++ nss-3.12.3/mozilla/security/coreconf/config.mk
-@@ -58,17 +58,17 @@
- #       (dependent upon <architecture> tags)                          #
- #                                                                     #
- #       We are moving towards just having a $(OS_TARGET).mk file      #
- #       as opposed to multiple $(OS_TARGET)$(OS_RELEASE).mk files,    #
- #       one for each OS release.                                      #
+Index: nss-3.12.6/mozilla/security/coreconf/config.mk
+===================================================================
+--- nss-3.12.6.orig/mozilla/security/coreconf/config.mk	2009-08-25 23:35:11.000000000 +0100
++++ nss-3.12.6/mozilla/security/coreconf/config.mk	2010-03-25 13:48:26.623067512 +0000
+@@ -63,7 +63,7 @@
  #######################################################################
  
  TARGET_OSES = FreeBSD BSD_OS NetBSD OpenUNIX OS2 QNX Darwin BeOS OpenBSD \
--              OpenVMS AIX RISCOS WINNT WIN95 WINCE
-+              OpenVMS AIX RISCOS WINNT WIN95 WINCE GNU GNU_%
+-              AIX RISCOS WINNT WIN95 WINCE
++              AIX RISCOS WINNT WIN95 WINCE GNU GNU_%
  
  ifeq (,$(filter-out $(TARGET_OSES),$(OS_TARGET)))
  include $(CORE_DEPTH)/coreconf/$(OS_TARGET).mk
- else
- include $(CORE_DEPTH)/coreconf/$(OS_TARGET)$(OS_RELEASE).mk
- endif
- 
- #######################################################################

=== modified file 'debian/patches/38_mips64_build.patch'
--- debian/patches/38_mips64_build.patch	2008-08-17 20:48:05 +0000
+++ debian/patches/38_mips64_build.patch	2010-03-29 11:55:44 +0000
@@ -1,18 +1,13 @@
 ---
- mozilla/security/coreconf/Linux.mk |    4 ++++
+ Linux.mk |    4 ++++
  1 file changed, 4 insertions(+)
 
-Index: nss-3.12.1~rc1/mozilla/security/coreconf/Linux.mk
+Index: nss-3.12.5/mozilla/security/coreconf/Linux.mk
 ===================================================================
---- nss-3.12.1~rc1.orig/mozilla/security/coreconf/Linux.mk
-+++ nss-3.12.1~rc1/mozilla/security/coreconf/Linux.mk
-@@ -85,27 +85,31 @@
- 	CPU_ARCH        = arm
- else
- ifeq ($(OS_TEST),parisc)
- 	CPU_ARCH        = hppa
- else
- ifeq ($(OS_TEST),parisc64)
+--- nss-3.12.5.orig/mozilla/security/coreconf/Linux.mk	2010-03-24 14:12:33.052504575 +0000
++++ nss-3.12.5/mozilla/security/coreconf/Linux.mk	2010-03-24 14:13:27.394999573 +0000
+@@ -87,6 +87,9 @@
+ ifeq (,$(filter-out parisc%,$(OS_TEST)))
  	CPU_ARCH        = hppa
  else
 +ifeq ($(OS_TEST),mips64)
@@ -21,11 +16,7 @@
  ifeq (,$(filter-out i686 i586 i486 i386,$(OS_TEST)))
  	OS_REL_CFLAGS	+= -Di386
  	CPU_ARCH	= x86
- endif
- endif
- endif
- endif
- endif
+@@ -106,6 +109,7 @@
  endif
  endif
  endif
@@ -33,8 +24,3 @@
  
  
  LIBC_TAG		= _glibc
- 
- ifeq ($(KERNEL)-$(OS_RELEASE),linux-2.0)
- 	OS_REL_CFLAGS	+= -DLINUX2_0
- 	MKSHLIB		= $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so)
- 	ifdef MAPFILE

=== modified file 'debian/patches/85_security_load.patch'
--- debian/patches/85_security_load.patch	2009-06-16 11:17:52 +0000
+++ debian/patches/85_security_load.patch	2010-03-29 11:55:44 +0000
@@ -1,12 +1,55 @@
-85_security_load.dpatch by Mike Hommey <[e-mail]>
-
-All lines beginning with `## DP:' are a description of the patch.
-DP: Load modules from $ORIGIN/nss.
-
--- 
---- nss/mozilla/security/nss/lib/freebl/genload.c
-+++ nss/mozilla/security/nss/lib/freebl/genload.c
-@@ -113,9 +124,14 @@
+## 85_security_load.patch by Mike Hommey <[e-mail]>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: Load modules from $ORIGIN/nss.
+
+Index: nss-3.12.6/mozilla/security/nss/cmd/shlibsign/shlibsign.c
+===================================================================
+--- nss-3.12.6.orig/mozilla/security/nss/cmd/shlibsign/shlibsign.c	2008-11-20 15:44:12.000000000 +0000
++++ nss-3.12.6/mozilla/security/nss/cmd/shlibsign/shlibsign.c	2010-03-29 12:06:03.560531797 +0100
+@@ -769,6 +769,8 @@
+     libname = PR_GetLibraryName(NULL, "softokn3");
+     assert(libname != NULL);
+     lib = PR_LoadLibrary(libname);
++    if (!lib)
++        lib = PR_LoadLibrary("/usr/lib/nss/libsoftokn3.so");
+     assert(lib != NULL);
+     PR_FreeLibraryName(libname);
+ 
+Index: nss-3.12.6/mozilla/security/nss/lib/pk11wrap/pk11load.c
+===================================================================
+--- nss-3.12.6.orig/mozilla/security/nss/lib/pk11wrap/pk11load.c	2009-10-30 09:44:45.000000000 +0000
++++ nss-3.12.6/mozilla/security/nss/lib/pk11wrap/pk11load.c	2010-03-29 12:14:42.600534017 +0100
+@@ -393,6 +393,7 @@
+     SECStatus rv;
+     PRBool alreadyLoaded = PR_FALSE;
+     char *disableUnload = NULL;
++    char * tmp;
+ 
+     if (mod->loaded) return SECSuccess;
+ 
+@@ -440,6 +441,16 @@
+ 	 * unload the library if anything goes wrong from here on out...
+ 	 */
+ 	library = PR_LoadLibrary(full_name);
++	if (library == NULL) {
++            tmp = rindex(full_name, PR_GetDirectorySeparator());
++            if (tmp)
++                tmp++;
++            else
++                tmp = full_name;
++            library = PORT_LoadLibraryFromOrigin(my_shlib_name,
++                                      (PRFuncPtr) &softoken_LoadDSO,
++                                      tmp);
++	}
+ 	mod->library = (void *)library;
+ 	PORT_Free(full_name);
+ 
+Index: nss-3.12.6/mozilla/security/nss/lib/util/secload.c
+===================================================================
+--- nss-3.12.6.orig/mozilla/security/nss/lib/util/secload.c	2009-10-30 09:44:47.000000000 +0000
++++ nss-3.12.6/mozilla/security/nss/lib/util/secload.c	2010-03-29 12:06:03.560531797 +0100
+@@ -104,9 +104,14 @@
  
      /* Remove the trailing filename from referencePath and add the new one */
      c = strrchr(referencePath, PR_GetDirectorySeparator());
@@ -22,7 +65,7 @@
          if (fullName) {
              memcpy(fullName, referencePath, referencePathSize);
              strcpy(fullName + referencePathSize, name); 
-@@ -125,7 +141,17 @@
+@@ -116,6 +121,12 @@
  #endif
              libSpec.type = PR_LibSpec_Pathname;
              libSpec.value.pathname = fullName;
@@ -32,7 +75,13 @@
 +            }
 +            strcpy(fullName + referencePathSize, "nss/");
 +            strcpy(fullName + referencePathSize + 4, name);
-             dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
+             dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL
+ #ifdef PR_LD_ALT_SEARCH_PATH
+             /* allow library's dependencies to be found in the same directory
+@@ -123,6 +134,10 @@
+                                           | PR_LD_ALT_SEARCH_PATH 
+ #endif
+                                           );
 +            if (! dlh) {
 +                strcpy(fullName + referencePathSize, name);
 +                dlh = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
@@ -40,34 +89,3 @@
              PORT_Free(fullName);
          }
      }
---- nss/mozilla/security/nss/lib/pk11wrap/pk11load.c
-+++ nss/mozilla/security/nss/lib/pk11wrap/pk11load.c
-@@ -331,6 +331,14 @@
- #endif
- 
- 	if (library == NULL) {
-+	    full_name = rindex(mod->dllName, PR_GetDirectorySeparator());
-+	    if (full_name)
-+	        full_name++;
-+	    else
-+	        full_name = mod->dllName;
-+	    library = loader_LoadLibrary(full_name);
-+	}
-+	if (library == NULL) {
- 	    return SECFailure;
- 	}
- 
-diff --git a/mozilla/security/nss/cmd/shlibsign/shlibsign.c b/mozilla/security/nss/cmd/shlibsign/shlibsign.c
-index 6e93225..501e70b 100644
---- a/mozilla/security/nss/cmd/shlibsign/shlibsign.c
-+++ b/mozilla/security/nss/cmd/shlibsign/shlibsign.c
-@@ -769,6 +769,8 @@ int main(int argc, char **argv)
-     libname = PR_GetLibraryName(NULL, "softokn3");
-     assert(libname != NULL);
-     lib = PR_LoadLibrary(libname);
-+    if (!lib)
-+        lib = PR_LoadLibrary("/usr/lib/nss/libsoftokn3.so");
-     assert(lib != NULL);
-     PR_FreeLibraryName(libname);
- 
-