Merge ~lucaskanashiro/ubuntu/+source/nss:merge-focal into ubuntu/+source/nss:debian/sid

[Lucas Kanashiro]

Merge version 2:3.47-1 from Debian. The delta from version 2:3.45-1ubuntu2 was applied on top of this new release:

* d/libnss3.links: make freebl3 available as library
* d/control: add dh-exec to Build-Depends
* d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
* Disable reading fips_enabled flag in FIPS mode. libnss is not a FIPS certified library.

According to upstream release notes the library in this new release is compatible with the version we have in the archive, so the version bump should not be a problem.

[Lucas Kanashiro (lucaskanashiro)]

The package builds fine and it was uploaded to this PPA: https://launchpad.net/~lucaskanashiro/+archive/ubuntu/focal-nss-merge/

[Christian Ehrhardt  (paelzer)]

Recommendation: switch on nonx86 architectures on the PPA to not hit late surprises on upload

[Christian Ehrhardt  (paelzer)]

build - ok
retained delta - ok (nothing upstreamable, not sure why debian dislikes freebl3)
changelog - ok

[Christian Ehrhardt  (paelzer)]

It has quite a long list of reverse dependencies which makes this dangerous.
I agree that we don't see a bump of the major number of the lib so it might be working out well.

I was checking
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.46_release_notes
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.47_release_notes

It is a bit tricky, there were significant TLS changes announced for 3.47 in the 3.46 doc. Only to be listed still as future in 3.47 release note.

It also contains the statement you probably meant that it should be compatible.
Yeah it seems safe in that regard.

[Christian Ehrhardt  (paelzer)]

But the notes also contain:
  "The HG tag is NSS_3_47_RTM. NSS 3.47 requires NSPR 4.23 or newer."

Well at least in f-proposed that is ok:
 libnspr4 | 2:4.23-1 | focal-proposed | amd64, arm64, armhf, i386, ppc64el, s390x

[Christian Ehrhardt  (paelzer)]

Yeah, overall this LGTM.
Be prepared that due to the longer list of dependencies there might be more potential hickups in tests. But that won't change, so if you are ok it can be sponsored.

review: Approve

[Lucas Kanashiro (lucaskanashiro)]

> Recommendation: switch on nonx86 architectures on the PPA to not hit late
> surprises on upload

Thanks for the heads up Christian. Do you usually build packages for all architectures? Or do you have a small set that is "more valuable" in general?

[Lucas Kanashiro (lucaskanashiro)]

> Yeah, overall this LGTM.
> Be prepared that due to the longer list of dependencies there might be more
> potential hickups in tests. But that won't change, so if you are ok it can be
> sponsored.

I am ok with it, could you please sponsor it?

[Christian Ehrhardt  (paelzer)]

I usually build all that the main archive builds for: amd64, i386, armhf, arm64, ppc64el, s390x.
As those are the ones that should work well on the actual upload.
No one cares about e.g. "powerpc" anymore these days.

As agreed, sponsoring ...

[Christian Ehrhardt  (paelzer)]

Tagged and uploaded to Focal

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/nss
 * [new tag] upload/2%3.47-1ubuntu1 -> upload/2%3.47-1ubuntu1

And I see https://launchpad.net/ubuntu/+source/nss/2:3.47-1ubuntu1 started building

[Christian Ehrhardt  (paelzer)]

This is in the release pocket

diff --git a/debian/changelog b/debian/changelog
index 4e90a94..6acea72 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+nss (2:3.47-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 31 Oct 2019 16:18:35 -0300
+
 nss (2:3.47-1) unstable; urgency=medium
 
   * New upstream release.
@@ -5,6 +16,22 @@ nss (2:3.47-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 23 Oct 2019 11:19:59 +0900
 
+nss (2:3.45-1ubuntu2) eoan; urgency=medium
+
+  * Disable reading fips_enabled flag in FIPS mode. libnss is
+    not a FIPS certified library. (LP: #1837734)
+
+ -- Vineetha Kamath <[e-mail]>  Tue, 23 Jul 2019 20:58:12 +0000
+
+nss (2:3.45-1ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Gianfranco Costamagna <[e-mail]>  Thu, 11 Jul 2019 11:49:44 +0200
+
 nss (2:3.45-1) unstable; urgency=medium
 
   * New upstream release.
@@ -53,6 +80,28 @@ nss (2:3.42.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 13 Feb 2019 13:19:39 +0900
 
+nss (2:3.42-1ubuntu2) disco; urgency=medium
+
+  * SECURITY UPDATE: DoS in NULL pointer dereference in CMS functions
+    - debian/patches/CVE-2018-18508-1.patch: add null checks in
+      nss/lib/smime/cmscinfo.c, nss/lib/smime/cmsdigdata.c,
+      nss/lib/smime/cmsencdata.c, nss/lib/smime/cmsenvdata.c,
+      nss/lib/smime/cmsmessage.c, nss/lib/smime/cmsudf.c.
+    - debian/patches/CVE-2018-18508-2.patch: add null checks in
+      nss/lib/smime/cmsmessage.c.
+    - CVE-2018-18508
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 19 Feb 2019 12:04:49 +0100
+
+nss (2:3.42-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1813593). Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Karl Stenerud <[e-mail]>  Mon, 04 Feb 2019 11:03:32 +0100
+
 nss (2:3.42-1) unstable; urgency=medium
 
   * New upstream release.
@@ -71,6 +120,18 @@ nss (2:3.40-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 02 Nov 2018 14:44:19 +0900
 
+nss (2:3.39-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes (LP: #1803707):
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+  * Dropped changes:
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Nov 2018 14:27:39 +0100
+
 nss (2:3.39-1) unstable; urgency=medium
 
   * New upstream release.
@@ -103,6 +164,23 @@ nss (2:3.37-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 14 May 2018 07:15:21 +0900
 
+nss (2:3.36.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+  * Dropped changes:
+    - revert switching to SQL default format (LP: 1746947) Dropping this
+      adresses (LP: #1747411) and effectively means we now switch to the new
+      default format after we ensured all depending packages are ready.
+  * Added changes:
+    - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 May 2018 17:08:46 +0200
+
 nss (2:3.36.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -116,6 +194,25 @@ nss (2:3.36-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sun, 08 Apr 2018 06:53:15 +0900
 
+nss (2:3.35-2ubuntu2) bionic; urgency=medium
+
+  * d/p/lp1746947-revert-switch-default-to-sql.patch: the switch of the
+    default is still causing too much issues in consumers of nss.
+    So until resolved revert the switched default (LP: #1746947)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 05 Feb 2018 11:36:07 +0100
+
+nss (2:3.35-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+  * Added Changes:
+    - d/libnss3.links: make freebl3 available as library (LP: #1744328)
+      + d/control: add dh-exec to Build-Depends
+      + d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 30 Jan 2018 14:04:20 +0100
+
 nss (2:3.35-2) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Build Hacl_Poly1305_64.o on arm64.
@@ -134,6 +231,13 @@ nss (2:3.34.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 05 Jan 2018 20:15:40 +0900
 
+nss (2:3.34-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 14 Dec 2017 09:18:47 -0500
+
 nss (2:3.34-1) unstable; urgency=medium
 
   * New upstream release:
@@ -158,6 +262,28 @@ nss (2:3.32-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 28 Aug 2017 07:39:59 +0900
 
+nss (2:3.32-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
+    - debian/patches/CVE-2017-7805.patch: Simplify handling of
+      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
+    - CVE-2017-7805
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 29 Sep 2017 12:17:39 -0400
+
+nss (2:3.32-1ubuntu2) artful; urgency=medium
+
+  * Initialise curve variable in a test file, resolves FTBFS.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 24 Aug 2017 07:21:27 -0400
+
+nss (2:3.32-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 23 Aug 2017 13:09:20 -0400
+
 nss (2:3.32-1) unstable; urgency=medium
 
   * New upstream release.
@@ -217,6 +343,39 @@ nss (2:3.27.1-1) experimental; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sat, 19 Nov 2016 08:29:17 +0900
 
+nss (2:3.28.4-0ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: DoS via empty SSLv2 messages
+    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
+      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
+      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
+      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
+      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
+    - CVE-2017-7502
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Jun 2017 08:12:38 -0400
+
+nss (2:3.28.4-0ubuntu1) artful; urgency=medium
+
+  * Updated to upstream 3.28.4 to fix security issues and get a new CA
+    certificate bundle.
+  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
+    - CVE-2016-2183
+  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
+    - CVE-2017-5461
+  * debian/patches/*.patch: refreshed for new version.
+  * debian/control: bump libnspr4-dev to 4.13.1.
+  * debian/libnss3.symbols: added new symbols.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 27 Apr 2017 13:13:44 -0400
+
+nss (2:3.26.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 02 Dec 2016 08:48:03 -0500
+
 nss (2:3.26.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -230,6 +389,13 @@ nss (2:3.26-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 21 Sep 2016 10:02:23 +0900
 
+nss (2:3.26-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Tue, 06 Sep 2016 14:39:56 +0200
+
 nss (2:3.26-1) unstable; urgency=medium
 
   * New upstream release.
@@ -244,6 +410,12 @@ nss (2:3.26-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Tue, 16 Aug 2016 16:33:15 +0900
 
+nss (2:3.25-1ubuntu1) yakkety; urgency=medium
+
+  * When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Thu, 04 Aug 2016 11:36:54 +0200
+
 nss (2:3.25-1) unstable; urgency=medium
 
   * New upstream release.
@@ -275,6 +447,7 @@ nss (2:3.21-1.1) unstable; urgency=medium
   * Fix FTBFS on hppa. Closes: #808990
 
  -- Adam Borowski <[e-mail]>  Sun, 14 Feb 2016 14:46:40 +0100
+
 nss (2:3.21-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index 90afcdc..54c1ae6 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,11 @@
 Source: nss
 Section: libs
 Priority: optional
-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
 Uploaders: Mike Hommey <[e-mail]>
 Build-Depends: debhelper (>= 9.20160403),
+ dh-exec,
  dpkg-dev (>= 1.17.14),
  libnspr4-dev (>= 2:4.12),
  zlib1g-dev,
diff --git a/debian/libnss3.links b/debian/libnss3.links
new file mode 100755
index 0000000..717ff94
--- /dev/null
+++ b/debian/libnss3.links
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.so
diff --git a/debian/patches/disable_fips_enabled_read.patch b/debian/patches/disable_fips_enabled_read.patch
new file mode 100644
index 0000000..7a87954
--- /dev/null
+++ b/debian/patches/disable_fips_enabled_read.patch
@@ -0,0 +1,49 @@
+commit 16996a9156c9ff2924bdb19ff43d40617a41c912
+Author: Vineetha Kamath <[e-mail]>
+Date:   Tue Jul 23 15:32:32 2019 -0400
+
+From: Vineetha Kamath<[e-mail]>
+Decription: Disable libgcrypt reading /proc/sys/crypto/fips_enabled
+file and going into FIPS mode. libnss is not a FIPS
+certified library.
+Bug-Ubuntu: http://bugs.launchpad.net/bugs/1837734
+Forwarded: not-needed
+
+diff --git a/nss/lib/freebl/nsslowhash.c b/nss/lib/freebl/nsslowhash.c
+index 22f9781..8433377 100644
+--- a/nss/lib/freebl/nsslowhash.c
++++ b/nss/lib/freebl/nsslowhash.c
+@@ -27,11 +27,13 @@ static int
+ nsslow_GetFIPSEnabled(void)
+ {
+ #ifdef LINUX
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f)
+         return 0;
+ 
+diff --git a/nss/lib/sysinit/nsssysinit.c b/nss/lib/sysinit/nsssysinit.c
+index bd0fac2..81f9b17 100644
+--- a/nss/lib/sysinit/nsssysinit.c
++++ b/nss/lib/sysinit/nsssysinit.c
+@@ -168,11 +168,13 @@ getFIPSEnv(void)
+ static PRBool
+ getFIPSMode(void)
+ {
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f) {
+         /* if we don't have a proc flag, fall back to the
+      * environment variable */
diff --git a/debian/patches/series b/debian/patches/series
index c1bd63f..3f8bf6a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -2,3 +2,4 @@
 80_security_tools.patch
 85_security_load.patch
 38_hppa.patch
+disable_fips_enabled_read.patch
diff --git a/debian/rules b/debian/rules
index ec951d3..b4c7302 100755
--- a/debian/rules
+++ b/debian/rules
@@ -175,7 +175,7 @@ override_dh_strip:
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works
-	mkdir debian/tmp
+	mkdir -p debian/tmp
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -create -dbdir debian/tmp < /dev/null
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -fips true -dbdir debian/tmp < /dev/null
 endif