Merge ~paelzer/ubuntu/+source/nss:merge-1803707-disco-3.39-1 into ubuntu/+source/nss:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

There is a PPA at:
https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3523/+packages

That also proves that we no more need the PPC FTBFS fix that I dropped.

Sponsoring this has to wait until nspr is complete, but Karl is ready to push it so that should be soon.
Also there is nothing bad in doing the review early.

Once I have the new nspr in proposed I'd intend to rebuild nss and then run test-nss.py from qa-regression tests on it.

[Robie Basak (racb)]

Did you forget to push the logical/reconstruct/deconstruct tags? I don't see a recent set.

review: Needs Information

[Christian Ehrhardt  (paelzer)]

Sorry, here they are:

To ssh://git.launchpad.net/~paelzer/ubuntu/+source/nss
 * [new tag] lp1803707/reconstruct/2%3.36.1-1ubuntu1 -> lp1803707/reconstruct/2%3.36.1-1ubuntu1
 * [new tag] lp1803707/old/ubuntu -> lp1803707/old/ubuntu
 * [new tag] lp1803707/old/debian -> lp1803707/old/debian
 * [new tag] lp1803707/new/debian -> lp1803707/new/debian
 * [new tag] lp1803707/logical/2%3.36.1-1ubuntu1 -> lp1803707/logical/2%3.36.1-1ubuntu1
 * [new tag] lp1803707/deconstruct/2%3.36.1-1ubuntu1 -> lp1803707/deconstruct/2%3.36.1-1ubuntu1

[Robie Basak (racb)]

$ git range-diff old/debian..paelzer/lp1803707/logical/2%3.36.1-1ubuntu1 new/debian..paelzer/merge-1803707-disco-3.39-1
1: 58c31039 = 1: 8ebf867f - d/libnss3.links: make freebl3 available as library (LP: 1744328)
2: a75d84d4 = 2: c378d1eb - d/control: add dh-exec to Build-Depends
3: caf5abf5 = 3: f052d968 - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
4: 95c075a0 < -: -------- - When building with -O3 on ppc64el this FTBFS, build with -Wno-error=maybe-uninitialized to avoid that
-: -------- > 4: 527dabf0 merge-changelogs
-: -------- > 5: cdb3fef4 reconstruct-changelog
-: -------- > 6: bea8361d update-maintainer
-: -------- > 7: 4063cb52 changelog: clear changelog for merge
-: -------- > 8: eeeada1d changelog: add merge bug reference

All previous delta transferred correctly. Matches changelog entry. The changelog is correct with correct bug reference, version string and target release. The FTBFS drop makes sense - when it builds we'll see if it works, and if it does then dropping the FTBFS delta is obviously correct.

All changes dropped were appropriately dropped. All previous delta still kept is still correct and appropriate to keep. No new changes.

merge-changelogs and update-maintainer look applied correctly.

lgtm

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks, the PPA already shows that it builds fine.
And since I intend to go after NSPR there will be another build before the upload - so twice the build checks for extra confidence :-)

[Christian Ehrhardt  (paelzer)]

Most of the qa tests didn't work at all, so I fell back to the tests in python-nss which at least had a few working. Those worked after the upgrade just as much.

NSPR (build-dep) is complete and nss rebuilt fine against it and all self tests were good.
Uploading ....

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/nss
 * [new tag] upload/2%3.39-1ubuntu1 -> upload/2%3.39-1ubuntu1

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nss_3.39-1ubuntu1.dsc: done.
  Uploading nss_3.39.orig.tar.gz: done.
  Uploading nss_3.39-1ubuntu1.debian.tar.xz: done.
  Uploading nss_3.39-1ubuntu1_source.buildinfo: done.
  Uploading nss_3.39-1ubuntu1_source.changes: done.
Successfully uploaded packages.

https://launchpad.net/ubuntu/+source/nss/2:3.39-1ubuntu1

diff --git a/debian/changelog b/debian/changelog
index 8365a02..3a2a518 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+nss (2:3.39-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes (LP: #1803707):
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+  * Dropped changes:
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Nov 2018 14:27:39 +0100
+
 nss (2:3.39-1) unstable; urgency=medium
 
   * New upstream release.
@@ -30,6 +42,23 @@ nss (2:3.37-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 14 May 2018 07:15:21 +0900
 
+nss (2:3.36.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+  * Dropped changes:
+    - revert switching to SQL default format (LP: 1746947) Dropping this
+      adresses (LP: #1747411) and effectively means we now switch to the new
+      default format after we ensured all depending packages are ready.
+  * Added changes:
+    - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 May 2018 17:08:46 +0200
+
 nss (2:3.36.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -43,6 +72,25 @@ nss (2:3.36-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sun, 08 Apr 2018 06:53:15 +0900
 
+nss (2:3.35-2ubuntu2) bionic; urgency=medium
+
+  * d/p/lp1746947-revert-switch-default-to-sql.patch: the switch of the
+    default is still causing too much issues in consumers of nss.
+    So until resolved revert the switched default (LP: #1746947)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 05 Feb 2018 11:36:07 +0100
+
+nss (2:3.35-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+  * Added Changes:
+    - d/libnss3.links: make freebl3 available as library (LP: #1744328)
+      + d/control: add dh-exec to Build-Depends
+      + d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 30 Jan 2018 14:04:20 +0100
+
 nss (2:3.35-2) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Build Hacl_Poly1305_64.o on arm64.
@@ -61,6 +109,13 @@ nss (2:3.34.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 05 Jan 2018 20:15:40 +0900
 
+nss (2:3.34-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 14 Dec 2017 09:18:47 -0500
+
 nss (2:3.34-1) unstable; urgency=medium
 
   * New upstream release:
@@ -85,6 +140,28 @@ nss (2:3.32-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 28 Aug 2017 07:39:59 +0900
 
+nss (2:3.32-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
+    - debian/patches/CVE-2017-7805.patch: Simplify handling of
+      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
+    - CVE-2017-7805
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 29 Sep 2017 12:17:39 -0400
+
+nss (2:3.32-1ubuntu2) artful; urgency=medium
+
+  * Initialise curve variable in a test file, resolves FTBFS.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 24 Aug 2017 07:21:27 -0400
+
+nss (2:3.32-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 23 Aug 2017 13:09:20 -0400
+
 nss (2:3.32-1) unstable; urgency=medium
 
   * New upstream release.
@@ -144,6 +221,39 @@ nss (2:3.27.1-1) experimental; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sat, 19 Nov 2016 08:29:17 +0900
 
+nss (2:3.28.4-0ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: DoS via empty SSLv2 messages
+    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
+      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
+      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
+      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
+      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
+    - CVE-2017-7502
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Jun 2017 08:12:38 -0400
+
+nss (2:3.28.4-0ubuntu1) artful; urgency=medium
+
+  * Updated to upstream 3.28.4 to fix security issues and get a new CA
+    certificate bundle.
+  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
+    - CVE-2016-2183
+  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
+    - CVE-2017-5461
+  * debian/patches/*.patch: refreshed for new version.
+  * debian/control: bump libnspr4-dev to 4.13.1.
+  * debian/libnss3.symbols: added new symbols.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 27 Apr 2017 13:13:44 -0400
+
+nss (2:3.26.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 02 Dec 2016 08:48:03 -0500
+
 nss (2:3.26.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -157,6 +267,13 @@ nss (2:3.26-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 21 Sep 2016 10:02:23 +0900
 
+nss (2:3.26-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Tue, 06 Sep 2016 14:39:56 +0200
+
 nss (2:3.26-1) unstable; urgency=medium
 
   * New upstream release.
@@ -171,6 +288,12 @@ nss (2:3.26-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Tue, 16 Aug 2016 16:33:15 +0900
 
+nss (2:3.25-1ubuntu1) yakkety; urgency=medium
+
+  * When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Thu, 04 Aug 2016 11:36:54 +0200
+
 nss (2:3.25-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index 90afcdc..54c1ae6 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,11 @@
 Source: nss
 Section: libs
 Priority: optional
-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
 Uploaders: Mike Hommey <[e-mail]>
 Build-Depends: debhelper (>= 9.20160403),
+ dh-exec,
  dpkg-dev (>= 1.17.14),
  libnspr4-dev (>= 2:4.12),
  zlib1g-dev,
diff --git a/debian/libnss3.links b/debian/libnss3.links
new file mode 100755
index 0000000..717ff94
--- /dev/null
+++ b/debian/libnss3.links
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.so
diff --git a/debian/rules b/debian/rules
index 880a07e..e5091f2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -175,7 +175,7 @@ override_dh_strip:
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works
-	mkdir debian/tmp
+	mkdir -p debian/tmp
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -create -dbdir debian/tmp < /dev/null
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -fips true -dbdir debian/tmp < /dev/null
 endif