source: postlfs/security/nss.xml

trunk
Last change on this file was 7a6a43b, checked in by Bruce Dubbs <bdubbs@…>, 5 weeks ago

Update to nss-3.99.
  • Property mode set to 100644
File size: 15.3 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions-->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_&nss-dir;_RTM/src/nss-&nss-version;.tar.gz">
15 <!ENTITY nss-download-ftp " ">
16 <!ENTITY nss-md5sum "a9e62202ca3d6b542b9318bb05bb7027">
17 <!ENTITY nss-size "73 MB">
18 <!ENTITY nss-buildsize "304 MB (add 268 MB for tests)">
19 <!ENTITY nss-time "1.1 SBU (with parallelism=4, add 16 SBU for tests on AMD Ryzens or at least 30 SBU on Intel machines)">
20 <!-- On my system, I got 64.2 SBU, but Bruce gets 18 SBU. -renodr -->
21 <!-- On my system, I got 63 SBU, but Xi gets ~18 SBU. -pierre (for 3.78) -->
22 <!-- On my 3400G for 3.79 I got 16 SBU -ken -->
23 <!-- Still 17 SBU for 3.81 - bdubbs -->
24 <!-- 73 SBU but I'm on Intel. -renodr -->
25 <!-- 3.86 amended the figures -ken
26 3400G 14 SBU with 6.0.12, but the remeasured SBU has become very slow
27 and maybe other people would see a ster SBU on a fresh build;
28 i7-4790 35 SBU with 6.0.12, no failures
29 Bruce's 3900X 19.3 SBU, his i7-12700K about 30 SBU, 12 failures
30
31 3.93:
32 Passed: 69982
33 Failed: 0
34 Failed with core: 0
35 ASan failures: 0
36 Unknown status: 2
37 TinderboxPrint:Unknown: 2
38
39 Test Results 3.95: (Intel i9-10900k) I got close to 70 SBU [rahul]
40
41 Passed: 69982
42 Failed: 0
43 Failed with core: 0
44 ASan failures: 0
45 Unknown status: 2
46 TinderboxPrint:Unknown: 2
47
48 Test Results 3.96: (AMD Ryzen 9 3900X) about 14 SBU [bdubbs]
49 Passed: 70289
50 Failed: 0
51 Failed with core: 0
52 ASan failures: 0
53 Unknown status: 2
54 TinderboxPrint:Unknown: 2
55
56 Test Results 3.97: (AMD Ryzen 7 1700) about 16 SBU [rahul]
57 Passed: 69809
58 Failed: 0
59 Failed with core: 0
60 ASan failures: 0
61 Unknown status: 2
62 TinderboxPrint:Unknown: 2
63
64 Test results 3.98: (Intel Xeon E5-1650v3) 25 SBU [renodr]
65 Tests summary:
66 Passed: 69919
67 Failed: 0
68 Failed with core: 0
69 ASan failures: 0
70 Unknown status: 2
71 TinderboxPrint:Unknown: 2
72
73 Test results 3.99: (AMD Ryzen 9 3900X) 14 SBU [bdubbs]
74 Tests summary:
75 Passed: 69953
76 Failed: 0
77 Failed with core: 0
78 ASan failures: 0
79 Unknown status: 2
80 TinderboxPrint:Unknown: 2
81 -->
82]>
83
84<sect1 id="nss" xreflabel="nss-&nss-version;">
85 <?dbhtml filename="nss.html"?>
86
87 <title>NSS-&nss-version;</title>
88
89 <indexterm zone="nss">
90 <primary sortas="a-NSS">NSS</primary>
91 </indexterm>
92
93 <sect2 role="package">
94 <title>Introduction to NSS</title>
95
96 <para>
97 The Network Security Services (<application>NSS</application>) package is
98 a set of libraries designed to support cross-platform development of
99 security-enabled client and server applications. Applications built with
100 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
101 S/MIME, X.509 v3 certificates, and other security standards. This is
102 useful for implementing SSL and S/MIME or other Internet security
103 standards into an application.
104 </para>
105
106 &lfs121_checked;
107
108 <bridgehead renderas="sect3">Package Information</bridgehead>
109 <itemizedlist spacing="compact">
110 <listitem>
111 <para>
112 Download (HTTP): <ulink url="&nss-download-http;"/>
113 </para>
114 </listitem>
115 <listitem>
116 <para>
117 Download (FTP): <ulink url="&nss-download-ftp;"/>
118 </para>
119 </listitem>
120 <listitem>
121 <para>
122 Download MD5 sum: &nss-md5sum;
123 </para>
124 </listitem>
125 <listitem>
126 <para>
127 Download size: &nss-size;
128 </para>
129 </listitem>
130 <listitem>
131 <para>
132 Estimated disk space required: &nss-buildsize;
133 </para>
134 </listitem>
135 <listitem>
136 <para>
137 Estimated build time: &nss-time;
138 </para>
139 </listitem>
140 </itemizedlist>
141
142 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
143 <itemizedlist spacing="compact">
144 <listitem>
145 <para>
146 Required patch:
147 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
148 </para>
149 </listitem>
150<!--
151 <listitem>
152 <para>
153 Required patch for processors lacking the <quote>adx</quote>
154 instruction set:
155 <ulink url="&patch-root;/nss-&nss-version;-illegal_instruction-1.patch"/>
156 </para>
157 </listitem>
158-->
159 </itemizedlist>
160
161 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
162
163 <bridgehead renderas="sect4">Required</bridgehead>
164 <para role="required">
165 <xref linkend="nspr"/>
166 </para>
167
168 <bridgehead renderas="sect4">Recommended</bridgehead>
169 <para role="recommended">
170 <xref linkend="sqlite"/> and
171 <xref role="runtime" linkend="p11-kit"/> (runtime)
172 </para>
173
174 <para condition="html" role="usernotes">
175 Editor Notes: <ulink url="&blfs-wiki;/nss"/>
176 </para>
177 </sect2>
178
179 <sect2 role="installation">
180 <title>Installation of NSS</title>
181
182<!--
183 <note>
184 <para>
185 Some old generations processors lack an assembler instruction that
186 is generated unconditionally by NSS-3.90. It leads to an
187 "illegal instruction" fault when running firefox. The availability
188 of this instruction is asserted by the <quote>adx</quote> flag
189 in <filename>/proc/cpuinfo</filename>. If this flag is not set,
190 apply the following patch:
191 </para>
192 </note>
193
194<screen><userinput>grep -q adx /proc/cpuinfo || \
195patch -Np1 -i ../nss-&nss-version;-illegal_instruction-1.patch</userinput></screen>
196
197-->
198 <para>
199 Install <application>NSS</application> by running the following commands:
200 </para>
201
202<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
203
204cd nss &amp;&amp;
205
206make BUILD_OPT=1 \
207 NSPR_INCLUDE_DIR=/usr/include/nspr \
208 USE_SYSTEM_ZLIB=1 \
209 ZLIB_LIBS=-lz \
210 NSS_ENABLE_WERROR=0 \
211 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
212 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
213
214 <para>
215 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
216 To run the tests, execute the following commands<!--(1 test is known to fail)-->:
217 </para>
218
219<screen remap="test"><userinput>cd tests &amp;&amp;
220HOST=localhost DOMSUF=localdomain ./all.sh
221cd ../</userinput></screen>
222
223 <note>
224 <para>Some information about the tests:</para>
225 <itemizedlist spacing="compact">
226 <listitem>
227 <para>
228 HOST=localhost and DOMSUF=localdomain are required.
229 Without these variables, a FQDN is
230 required to be specified and this generic way should work for
231 everyone, provided <systemitem>localhost.localdomain</systemitem>
232 is defined
233 <phrase revision='sysv'>
234 in <filename>/etc/hosts</filename>, as done in
235 <ulink url="&lfs-root;/chapter09/network.html#ch-config-hosts">
236 the LFS book</ulink>.
237 </phrase>
238 <phrase revision='systemd'>
239 by the <systemitem class='library'>myhostname</systemitem>
240 Name Service Switch module, as specified in
241 <ulink url="&lfs-root;/chapter08/glibc.html#conf-glibc">
242 the LFS book</ulink>.
243 </phrase>
244 </para>
245 </listitem>
246 <listitem>
247 <para>
248 The tests take a long time to run. If desired there is
249 information in the all.sh script about running subsets of the
250 total test suite.
251 </para>
252 </listitem>
253 <listitem>
254 <para>
255 When interrupting the tests, the test suite
256 fails to spin down test servers that are run. This leads to an
257 infinite loop in the tests where the test suite tries to kill a server
258 that doesn't exist anymore because it pulls the wrong PID.
259 </para>
260 </listitem>
261 <listitem>
262 <para>
263 Test suite results (in HTML format!) can be found at
264 ../../test_results/security/localhost.1/results.html
265 </para>
266 </listitem>
267 <listitem>
268 <para>
269 A few tests might fail on some Intel machines for unknown reasons.
270 </para>
271 </listitem>
272 </itemizedlist>
273 </note>
274
275 <para>
276 Now, as the <systemitem class="username">root</systemitem> user:
277 </para>
278
279<screen role="root"><userinput>cd ../dist &amp;&amp;
280
281install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
282install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
283
284install -v -m755 -d /usr/include/nss &amp;&amp;
285cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
286
287install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
288
289install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
290
291 </sect2>
292
293 <sect2 role="commands">
294 <title>Command Explanations</title>
295
296 <para>
297 <parameter>BUILD_OPT=1</parameter>: This option is passed to
298 <command>make</command> so that the build is performed with no debugging
299 symbols built into the binaries and the default compiler optimizations are
300 used.
301 </para>
302
303 <para>
304 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
305 sets the location of the nspr headers.
306 </para>
307
308 <para>
309 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
310 <command>make</command> to ensure that the
311 <filename class="libraryfile">libssl3.so</filename> library is linked to
312 the system installed <application>zlib</application> instead of the
313 in-tree version.
314 </para>
315
316 <para>
317 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
318 linker flags needed to link to the system <application>zlib</application>.
319 </para>
320
321 <para>
322 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
323 The <parameter>USE_64=1</parameter> option is <emphasis>required on
324 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
325 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
326 has no effect on a 32 bit system.
327 </para>
328
329 <para>
330 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
331 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
332 <application>sqlite</application> is installed and if so it
333 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
334 <command>make</command> so that
335 <filename class="libraryfile">libsoftokn3.so</filename> will link against
336 the system version of sqlite.
337 </para>
338
339 <para>
340 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
341 NSS test suite, append this option to <command>make</command> command,
342 to prevent the compilation of tests and save some build time.
343 </para>
344
345 </sect2>
346
347 <sect2 role="configuration">
348 <title>Configuring NSS</title>
349
350 <para>
351 If <xref linkend="p11-kit"/> is installed, the
352 <application>p11-kit</application> trust module
353 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
354 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
355 transparently make the system CAs available to
356 <application>NSS</application> aware applications, rather than the static
357 library provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
358 <systemitem class="username">root</systemitem> user, execute the following
359 command:
360 </para>
361
362<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
363
364 <para>
365 Additionally, for dependent applications that do not use the internal
366 database (<filename>/usr/lib/libnssckbi.so</filename>), the
367 <filename>/usr/sbin/make-ca</filename> script included on the
368 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
369 <parameter>-n</parameter> switch, or by modifying the
370 <filename>/etc/make-ca/make-ca.conf</filename> file.
371 </para>
372
373 </sect2>
374
375 <sect2 role="content">
376 <title>Contents</title>
377
378 <segmentedlist>
379 <segtitle>Installed Programs</segtitle>
380 <segtitle>Installed Libraries</segtitle>
381 <segtitle>Installed Directories</segtitle>
382
383 <seglistitem>
384 <seg>
385 certutil, nss-config, and pk12util
386 </seg>
387 <seg>
388 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
389 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
390 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
391 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
392 and libssl3.so
393 </seg>
394 <seg>
395 /usr/include/nss
396 </seg>
397 </seglistitem>
398 </segmentedlist>
399
400 <variablelist>
401 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
402 <?dbfo list-presentation="list"?>
403 <?dbhtml list-presentation="table"?>
404
405 <varlistentry id="certutil">
406 <term><command>certutil</command></term>
407 <listitem>
408 <para>
409 is the Mozilla Certificate Database Tool. It is a command-line
410 utility that can create and modify the Netscape Communicator
411 cert8.db and key3.db database files. It can also list, generate,
412 modify, or delete certificates within the cert8.db file and create
413 or change the password, generate new public and private key pairs,
414 display the contents of the key database, or delete key pairs within
415 the key3.db file
416 </para>
417 <indexterm zone="nss certutil">
418 <primary sortas="b-certutil">certutil</primary>
419 </indexterm>
420 </listitem>
421 </varlistentry>
422
423 <varlistentry id="nss-config">
424 <term><command>nss-config</command></term>
425 <listitem>
426 <para>
427 is used to determine the NSS library settings of the installed NSS
428 libraries
429 </para>
430 <indexterm zone="nss nss-config">
431 <primary sortas="b-nss-config">nss-config</primary>
432 </indexterm>
433 </listitem>
434 </varlistentry>
435
436 <varlistentry id="pk12util">
437 <term><command>pk12util</command></term>
438 <listitem>
439 <para>
440 is a tool for importing certificates and keys from pkcs #12 files
441 into NSS or exporting them. It can also list certificates and keys
442 in such files
443 </para>
444 <indexterm zone="nss pk12util">
445 <primary sortas="b-pk12util">pk12util</primary>
446 </indexterm>
447 </listitem>
448 </varlistentry>
449
450 </variablelist>
451
452 </sect2>
453
454</sect1>
Note: See TracBrowser for help on using the repository browser.