Merge ~sergiodj/ubuntu/+source/nss:nss-merge-3.53.1-1ubuntu1 into ubuntu/+source/nss:debian/sid

[Sergio Durigan Junior]

This is the merge of nss 2:3.53.1-1 from Debian.

It is relatively trivial; only two changes were dropped (the two patches to address CVEs, which were fixed upstream), and the patch to disable reading the fips_enabled flag in FIPS mode had to be updated.

Other than that, the merge went smoothly. The package doesn't have dep8 tests, but I tested the new build by installing it inside a container, and then installing some reversing dependency of it, like openjdk-15-jre-headless.

The Debian package seems a bit abandoned; it still uses compat level 9, and contains many lintian warnings. I will see about submitting an MR to address some of them.

There is a PPA with the new package here:

https://launchpad.net/~sergiodj/+archive/ubuntu/nss-merge

[Lucas Kanashiro (lucaskanashiro)]

* Changelog:
  - [√] old content and logical tag match as expected
  - [√] changelog entry correct version and targeted codename
  - [x] changelog entries correct
  - [√] update-maintainer has been run

* Actual changes:
  - [√] no upstream changes to consider
  - [√] no further upstream version to consider
  - [√] debian changes look safe

* Old Delta:
  - [√] dropped changes are ok to be dropped
  - [√] nothing else to drop
  - [-] changes forwarded upstream/debian (if appropriate)

* New Delta:
  - [√] no new patches added
  - [-] patches match what was proposed upstream
  - [-] patches correctly included in debian/patches/series
  - [-] patches have correct DEP3 metadata

* Build/Test:
  - [√] build is ok
  - [√] verified PPA package installs/uninstalls
  - [-] autopkgtest against the PPA package passes
  - [√] sanity checks test fine

There is just a minor thing I noticed in your changelog and also on your commit messages, to avoid pinging the bugs fixed in previous releases let's remove the ":" from "LP: #NNNN". I can see one occurrence of that in the changelog: "Symlink chk files to fix self-verification in FIPS mode (LP: #1885562)"; and two on the commit messages: "Set TLSv1.2 as minimum TLS version. LP: #1856428" and "Symlink chk files to fix self-verification in FIPS mode (LP: #1885562)".

Other than that LGTM. When you get it fixed let me know and I can sponsor this upload for you.

review: Needs Fixing

[Sergio Durigan Junior (sergiodj)]

On Monday, July 20 2020, Lucas Kanashiro wrote:

> Review: Needs Fixing
>
> * Changelog:
> - [√] old content and logical tag match as expected
> - [√] changelog entry correct version and targeted codename
> - [x] changelog entries correct
> - [√] update-maintainer has been run
>
> * Actual changes:
> - [√] no upstream changes to consider
> - [√] no further upstream version to consider
> - [√] debian changes look safe
>
> * Old Delta:
> - [√] dropped changes are ok to be dropped
> - [√] nothing else to drop
> - [-] changes forwarded upstream/debian (if appropriate)
>
> * New Delta:
> - [√] no new patches added
> - [-] patches match what was proposed upstream
> - [-] patches correctly included in debian/patches/series
> - [-] patches have correct DEP3 metadata
>
> * Build/Test:
> - [√] build is ok
> - [√] verified PPA package installs/uninstalls
> - [-] autopkgtest against the PPA package passes
> - [√] sanity checks test fine
>
> There is just a minor thing I noticed in your changelog and also on
> your commit messages, to avoid pinging the bugs fixed in previous
> releases let's remove the ":" from "LP: #NNNN". I can see one
> occurrence of that in the changelog: "Symlink chk files to fix
> self-verification in FIPS mode (LP: #1885562)"; and two on the commit
> messages: "Set TLSv1.2 as minimum TLS version. LP: #1856428" and
> "Symlink chk files to fix self-verification in FIPS mode (LP:
> #1885562)".
>
> Other than that LGTM. When you get it fixed let me know and I can sponsor this upload for you.

Thanks for the review, Lucas.

Heh, coincidentally I was thinking about the ":" thing when I was
writing the commit messages, and I did a quick investigation to see if
other merges were dropping the colon, but I remember finding one that
didn't, so I decided to leave it on mine as well. But it obviously
makes sense to drop it: the bugs have all been fixed, and we wouldn't
want the merge to pollute them with more info.

I have addressed your request and dropped the colon from both the
changelog entry and the commit messages.

Thanks,

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Lucas Kanashiro (lucaskanashiro)]

Thanks Sergio, I already sponsored the upload for you, please follow its migration.

$ git push pkg upload/2%3.53.1-1ubuntu1
Enumerating objects: 50, done.
Counting objects: 100% (50/50), done.
Delta compression using up to 8 threads
Compressing objects: 100% (31/31), done.
Writing objects: 100% (43/43), 8.30 KiB | 1.04 MiB/s, done.
Total 43 (delta 19), reused 26 (delta 12)
remote: Checking connectivity: 43, done.
To ssh://git.launchpad.net/ubuntu/+source/nss
 * [new tag] upload/2%3.53.1-1ubuntu1 -> upload/2%3.53.1-1ubuntu1

$ dput ubuntu ../nss_3.53.1-1ubuntu1_source.changes
Checking signature on .changes
gpg: ../nss_3.53.1-1ubuntu1_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../nss_3.53.1-1ubuntu1.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading nss_3.53.1-1ubuntu1.dsc: done.
  Uploading nss_3.53.1-1ubuntu1.debian.tar.xz: done.
  Uploading nss_3.53.1-1ubuntu1_source.changes: done.
Successfully uploaded packages.

review: Approve

[Sergio Durigan Junior (sergiodj)]

This has migrated.

diff --git a/debian/changelog b/debian/changelog
index 28834da..d02577d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,26 @@
+nss (2:3.53.1-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+    - Set TLSv1.2 as minimum TLS version. LP #1856428
+    - Symlink chk files to fix self-verification in FIPS mode (LP #1885562)
+  * Dropped changes:
+    - SECURITY UPDATE: Timing attack during DSA key generation
+      + debian/patches/CVE-2020-12399.patch: force a fixed length for DSA
+        exponentiation in nss/lib/freebl/dsa.c.
+      [ Incorporated by upstream. ]
+    - SECURITY UPDATE: Side channel vulnerabilities during RSA key generation
+      + debian/patches/CVE-2020-12402.patch: use constant-time GCD and
+        modular inversion in nss/lib/freebl/mpi/mpi.c,
+        nss/lib/freebl/mpi/mpi.h, nss/lib/freebl/mpi/mplogic.c.
+      [ Incorporated by upstream. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Fri, 17 Jul 2020 10:51:23 -0400
+
 nss (2:3.53.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -36,6 +59,43 @@ nss (2:3.50-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 12 Feb 2020 09:06:51 +0900
 
+nss (2:3.49.1-1ubuntu4) groovy; urgency=medium
+
+  * Symlink chk files to fix self-verification in FIPS mode (LP: #1885562)
+
+ -- Dariusz Gadomski <[e-mail]>  Wed, 01 Jul 2020 14:48:13 +0200
+
+nss (2:3.49.1-1ubuntu3) groovy; urgency=medium
+
+  * SECURITY UPDATE: Side channel vulnerabilities during RSA key generation
+    - debian/patches/CVE-2020-12402.patch: use constant-time GCD and
+      modular inversion in nss/lib/freebl/mpi/mpi.c,
+      nss/lib/freebl/mpi/mpi.h, nss/lib/freebl/mpi/mplogic.c.
+    - CVE-2020-12402
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 30 Jun 2020 10:41:20 -0400
+
+nss (2:3.49.1-1ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: Timing attack during DSA key generation
+    - debian/patches/CVE-2020-12399.patch: force a fixed length for DSA
+      exponentiation in nss/lib/freebl/dsa.c.
+    - CVE-2020-12399
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 10 Jun 2020 12:54:12 -0400
+
+nss (2:3.49.1-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+    - Set TLSv1.2 as minimum TLS version. LP #1856428
+
+ -- Lucas Kanashiro <[e-mail]>  Wed, 22 Jan 2020 16:24:44 -0300
+
 nss (2:3.49.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -55,6 +115,18 @@ nss (2:3.49-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Thu, 09 Jan 2020 13:46:11 +0900
 
+nss (2:3.48-1ubuntu1) focal; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+  * Set TLSv1.2 as minimum TLS version. LP: #1856428
+
+ -- Ubuntu Merge-o-Matic <[e-mail]>  Sun, 29 Dec 2019 03:43:36 +0000
+
 nss (2:3.48-1) unstable; urgency=medium
 
   * New upstream release. Closes: #947131.
@@ -71,6 +143,26 @@ nss (2:3.47.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 04 Dec 2019 09:00:54 +0900
 
+nss (2:3.47-1ubuntu2) focal; urgency=medium
+
+  * SECURITY UPDATE: out-of-bounds write in NSC_EncryptUpdate
+    - debian/patches/CVE-2019-11745.patch: use maxout not block size in
+      nss/lib/softoken/pkcs11c.c.
+    - CVE-2019-11745
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 26 Nov 2019 08:31:39 -0500
+
+nss (2:3.47-1ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP #1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - Disable reading fips_enabled flag in FIPS mode. libnss is
+      not a FIPS certified library. (LP #1837734)
+
+ -- Lucas Kanashiro <[e-mail]>  Thu, 31 Oct 2019 16:18:35 -0300
+
 nss (2:3.47-1) unstable; urgency=medium
 
   * New upstream release.
@@ -78,6 +170,22 @@ nss (2:3.47-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 23 Oct 2019 11:19:59 +0900
 
+nss (2:3.45-1ubuntu2) eoan; urgency=medium
+
+  * Disable reading fips_enabled flag in FIPS mode. libnss is
+    not a FIPS certified library. (LP: #1837734)
+
+ -- Vineetha Kamath <[e-mail]>  Tue, 23 Jul 2019 20:58:12 +0000
+
+nss (2:3.45-1ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Gianfranco Costamagna <[e-mail]>  Thu, 11 Jul 2019 11:49:44 +0200
+
 nss (2:3.45-1) unstable; urgency=medium
 
   * New upstream release.
@@ -126,6 +234,28 @@ nss (2:3.42.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 13 Feb 2019 13:19:39 +0900
 
+nss (2:3.42-1ubuntu2) disco; urgency=medium
+
+  * SECURITY UPDATE: DoS in NULL pointer dereference in CMS functions
+    - debian/patches/CVE-2018-18508-1.patch: add null checks in
+      nss/lib/smime/cmscinfo.c, nss/lib/smime/cmsdigdata.c,
+      nss/lib/smime/cmsencdata.c, nss/lib/smime/cmsenvdata.c,
+      nss/lib/smime/cmsmessage.c, nss/lib/smime/cmsudf.c.
+    - debian/patches/CVE-2018-18508-2.patch: add null checks in
+      nss/lib/smime/cmsmessage.c.
+    - CVE-2018-18508
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 19 Feb 2019 12:04:49 +0100
+
+nss (2:3.42-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable (LP: #1813593). Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+    - d/control: add dh-exec to Build-Depends
+    - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Karl Stenerud <[e-mail]>  Mon, 04 Feb 2019 11:03:32 +0100
+
 nss (2:3.42-1) unstable; urgency=medium
 
   * New upstream release.
@@ -144,6 +274,18 @@ nss (2:3.40-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 02 Nov 2018 14:44:19 +0900
 
+nss (2:3.39-1ubuntu1) disco; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes (LP: #1803707):
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+  * Dropped changes:
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 16 Nov 2018 14:27:39 +0100
+
 nss (2:3.39-1) unstable; urgency=medium
 
   * New upstream release.
@@ -176,6 +318,23 @@ nss (2:3.37-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 14 May 2018 07:15:21 +0900
 
+nss (2:3.36.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+  * Dropped changes:
+    - revert switching to SQL default format (LP: 1746947) Dropping this
+      adresses (LP: #1747411) and effectively means we now switch to the new
+      default format after we ensured all depending packages are ready.
+  * Added changes:
+    - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 May 2018 17:08:46 +0200
+
 nss (2:3.36.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -189,6 +348,25 @@ nss (2:3.36-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sun, 08 Apr 2018 06:53:15 +0900
 
+nss (2:3.35-2ubuntu2) bionic; urgency=medium
+
+  * d/p/lp1746947-revert-switch-default-to-sql.patch: the switch of the
+    default is still causing too much issues in consumers of nss.
+    So until resolved revert the switched default (LP: #1746947)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 05 Feb 2018 11:36:07 +0100
+
+nss (2:3.35-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+  * Added Changes:
+    - d/libnss3.links: make freebl3 available as library (LP: #1744328)
+      + d/control: add dh-exec to Build-Depends
+      + d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 30 Jan 2018 14:04:20 +0100
+
 nss (2:3.35-2) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Build Hacl_Poly1305_64.o on arm64.
@@ -207,6 +385,13 @@ nss (2:3.34.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 05 Jan 2018 20:15:40 +0900
 
+nss (2:3.34-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 14 Dec 2017 09:18:47 -0500
+
 nss (2:3.34-1) unstable; urgency=medium
 
   * New upstream release:
@@ -231,6 +416,28 @@ nss (2:3.32-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 28 Aug 2017 07:39:59 +0900
 
+nss (2:3.32-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
+    - debian/patches/CVE-2017-7805.patch: Simplify handling of
+      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
+    - CVE-2017-7805
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 29 Sep 2017 12:17:39 -0400
+
+nss (2:3.32-1ubuntu2) artful; urgency=medium
+
+  * Initialise curve variable in a test file, resolves FTBFS.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 24 Aug 2017 07:21:27 -0400
+
+nss (2:3.32-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 23 Aug 2017 13:09:20 -0400
+
 nss (2:3.32-1) unstable; urgency=medium
 
   * New upstream release.
@@ -290,6 +497,39 @@ nss (2:3.27.1-1) experimental; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sat, 19 Nov 2016 08:29:17 +0900
 
+nss (2:3.28.4-0ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: DoS via empty SSLv2 messages
+    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
+      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
+      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
+      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
+      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
+    - CVE-2017-7502
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Jun 2017 08:12:38 -0400
+
+nss (2:3.28.4-0ubuntu1) artful; urgency=medium
+
+  * Updated to upstream 3.28.4 to fix security issues and get a new CA
+    certificate bundle.
+  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
+    - CVE-2016-2183
+  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
+    - CVE-2017-5461
+  * debian/patches/*.patch: refreshed for new version.
+  * debian/control: bump libnspr4-dev to 4.13.1.
+  * debian/libnss3.symbols: added new symbols.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 27 Apr 2017 13:13:44 -0400
+
+nss (2:3.26.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 02 Dec 2016 08:48:03 -0500
+
 nss (2:3.26.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -303,6 +543,13 @@ nss (2:3.26-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 21 Sep 2016 10:02:23 +0900
 
+nss (2:3.26-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Tue, 06 Sep 2016 14:39:56 +0200
+
 nss (2:3.26-1) unstable; urgency=medium
 
   * New upstream release.
@@ -317,6 +564,12 @@ nss (2:3.26-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Tue, 16 Aug 2016 16:33:15 +0900
 
+nss (2:3.25-1ubuntu1) yakkety; urgency=medium
+
+  * When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Thu, 04 Aug 2016 11:36:54 +0200
+
 nss (2:3.25-1) unstable; urgency=medium
 
   * New upstream release.
@@ -348,6 +601,7 @@ nss (2:3.21-1.1) unstable; urgency=medium
   * Fix FTBFS on hppa. Closes: #808990
 
  -- Adam Borowski <[e-mail]>  Sun, 14 Feb 2016 14:46:40 +0100
+
 nss (2:3.21-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1263,3 +1517,4 @@ nss (3.11.5-1) experimental; urgency=low
   * Initial release. (Closes: #416151)
 
  -- Mike Hommey <[e-mail]>  Sun, 25 Mar 2007 23:56:17 +0200
+
diff --git a/debian/control b/debian/control
index a4be555..ac713a6 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,11 @@
 Source: nss
 Section: libs
 Priority: optional
-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
 Uploaders: Mike Hommey <[e-mail]>
 Build-Depends: debhelper (>= 9.20160403),
+ dh-exec,
  dpkg-dev (>= 1.17.14),
  libnspr4-dev (>= 2:4.24),
  zlib1g-dev,
diff --git a/debian/libnss3.links b/debian/libnss3.links
new file mode 100755
index 0000000..e62c6a0
--- /dev/null
+++ b/debian/libnss3.links
@@ -0,0 +1,5 @@
+#!/usr/bin/dh-exec
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.chk usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.chk
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.chk usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.chk
diff --git a/debian/patches/disable_fips_enabled_read.patch b/debian/patches/disable_fips_enabled_read.patch
new file mode 100644
index 0000000..c0e54d5
--- /dev/null
+++ b/debian/patches/disable_fips_enabled_read.patch
@@ -0,0 +1,49 @@
+commit 16996a9156c9ff2924bdb19ff43d40617a41c912
+Author: Vineetha Kamath <[e-mail]>
+Date:   Tue Jul 23 15:32:32 2019 -0400
+
+From: Vineetha Kamath<[e-mail]>
+Decription: Disable libgcrypt reading /proc/sys/crypto/fips_enabled
+file and going into FIPS mode. libnss is not a FIPS
+certified library.
+Bug-Ubuntu: http://bugs.launchpad.net/bugs/1837734
+Forwarded: not-needed
+
+Index: nss/nss/lib/freebl/nsslowhash.c
+===================================================================
+--- nss.orig/nss/lib/freebl/nsslowhash.c	2020-07-17 10:46:37.964346182 -0400
++++ nss/nss/lib/freebl/nsslowhash.c	2020-07-17 10:46:37.960346213 -0400
+@@ -27,11 +27,13 @@
+ nsslow_GetFIPSEnabled(void)
+ {
+ #ifdef LINUX
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f)
+         return 0;
+ 
+Index: nss/nss/lib/sysinit/nsssysinit.c
+===================================================================
+--- nss.orig/nss/lib/sysinit/nsssysinit.c	2020-07-17 10:46:37.964346182 -0400
++++ nss/nss/lib/sysinit/nsssysinit.c	2020-07-17 10:46:59.844174516 -0400
+@@ -171,11 +171,13 @@
+ getFIPSMode(void)
+ {
+ #ifndef NSS_FIPS_DISABLED
+-    FILE *f;
++    FILE *f = NULL;
+     char d;
+     size_t size;
+ 
++#if 0
+     f = fopen("/proc/sys/crypto/fips_enabled", "r");
++#endif
+     if (!f) {
+         /* if we don't have a proc flag, fall back to the
+      * environment variable */
diff --git a/debian/patches/series b/debian/patches/series
index 2f1226f..e8cd205 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,5 @@
 38_hppa.patch
 seed
 infinite-recursion
+disable_fips_enabled_read.patch
+set-tls1.2-as-minimum.patch
diff --git a/debian/patches/set-tls1.2-as-minimum.patch b/debian/patches/set-tls1.2-as-minimum.patch
new file mode 100644
index 0000000..a05d4e9
--- /dev/null
+++ b/debian/patches/set-tls1.2-as-minimum.patch
@@ -0,0 +1,17 @@
+Description: Set TLSv1.2 as minimum TLS version. LP: #1856428
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1856428
+
+
+Index: nss-3.48-1ubuntu1/nss/lib/ssl/sslsock.c
+===================================================================
+--- nss-3.48-1ubuntu1.orig/nss/lib/ssl/sslsock.c
++++ nss-3.48-1ubuntu1/nss/lib/ssl/sslsock.c
+@@ -96,7 +96,7 @@ static sslOptions ssl_defaults = {
+  * default range of enabled SSL/TLS protocols
+  */
+ static SSLVersionRange versions_defaults_stream = {
+-    SSL_LIBRARY_VERSION_TLS_1_0,
++    SSL_LIBRARY_VERSION_TLS_1_2,
+     SSL_LIBRARY_VERSION_TLS_1_3
+ };
+ 
diff --git a/debian/rules b/debian/rules
index ec951d3..b4c7302 100755
--- a/debian/rules
+++ b/debian/rules
@@ -175,7 +175,7 @@ override_dh_strip:
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works
-	mkdir debian/tmp
+	mkdir -p debian/tmp
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -create -dbdir debian/tmp < /dev/null
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -fips true -dbdir debian/tmp < /dev/null
 endif