source: postlfs/security/nss.xml@ 2e707bcd

12.1 ken/TL2024 lazarus plabs/newcss python3.11 rahul/power-profiles-daemon trunk xry111/llvm18
Last change on this file since 2e707bcd was a8d72e7d, checked in by Rahul Chandra <rahul@…>, 7 months ago

Update to nss-3.95
  • Property mode set to 100644
File size: 14.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions-->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_&nss-dir;_RTM/src/nss-&nss-version;.tar.gz">
15 <!ENTITY nss-download-ftp " ">
16 <!ENTITY nss-md5sum "aa53fba59dd58de418447c9857acee41">
17 <!ENTITY nss-size "74 MB">
18 <!ENTITY nss-buildsize "305 MB (add 142 MB for tests)">
19 <!ENTITY nss-time "1.2 SBU (with parallelism=4, add 15 SBU for tests on AMD Ryzens or at least 30 SBU on Intel machines)">
20 <!-- On my system, I got 64.2 SBU, but Bruce gets 18 SBU. -renodr -->
21 <!-- On my system, I got 63 SBU, but Xi gets ~18 SBU. -pierre (for 3.78) -->
22 <!-- On my 3400G for 3.79 I got 16 SBU -ken -->
23 <!-- Still 17 SBU for 3.81 - bdubbs -->
24 <!-- 73 SBU but I'm on Intel. -renodr -->
25 <!-- 3.86 amended the figures -ken
26 3400G 14 SBU with 6.0.12, but the remeasured SBU has become very slow
27 and maybe other people would see a ster SBU on a fresh build;
28 i7-4790 35 SBU with 6.0.12, no failures
29 Bruce's 3900X 19.3 SBU, his i7-12700K about 30 SBU, 12 failures
30
31 3.93:
32 Passed: 69982
33 Failed: 0
34 Failed with core: 0
35 ASan failures: 0
36 Unknown status: 2
37 TinderboxPrint:Unknown: 2
38 -->
39 <!-- Test Results 3.95: (Intel i9-10900k) I got close to 70 SBU [rahul]
40 Passed: 69982
41 Failed: 0
42 Failed with core: 0
43 ASan failures: 0
44 Unknown status: 2
45 TinderboxPrint:Unknown: 2
46 -->
47]>
48
49<sect1 id="nss" xreflabel="nss-&nss-version;">
50 <?dbhtml filename="nss.html"?>
51
52
53 <title>NSS-&nss-version;</title>
54
55 <indexterm zone="nss">
56 <primary sortas="a-NSS">NSS</primary>
57 </indexterm>
58
59 <sect2 role="package">
60 <title>Introduction to NSS</title>
61
62 <para>
63 The Network Security Services (<application>NSS</application>) package is
64 a set of libraries designed to support cross-platform development of
65 security-enabled client and server applications. Applications built with
66 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
67 S/MIME, X.509 v3 certificates, and other security standards. This is
68 useful for implementing SSL and S/MIME or other Internet security
69 standards into an application.
70 </para>
71
72 &lfs120_checked;
73
74 <bridgehead renderas="sect3">Package Information</bridgehead>
75 <itemizedlist spacing="compact">
76 <listitem>
77 <para>
78 Download (HTTP): <ulink url="&nss-download-http;"/>
79 </para>
80 </listitem>
81 <listitem>
82 <para>
83 Download (FTP): <ulink url="&nss-download-ftp;"/>
84 </para>
85 </listitem>
86 <listitem>
87 <para>
88 Download MD5 sum: &nss-md5sum;
89 </para>
90 </listitem>
91 <listitem>
92 <para>
93 Download size: &nss-size;
94 </para>
95 </listitem>
96 <listitem>
97 <para>
98 Estimated disk space required: &nss-buildsize;
99 </para>
100 </listitem>
101 <listitem>
102 <para>
103 Estimated build time: &nss-time;
104 </para>
105 </listitem>
106 </itemizedlist>
107
108 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
109 <itemizedlist spacing="compact">
110 <listitem>
111 <para>
112 Required patch:
113 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
114 </para>
115 </listitem>
116<!--
117 <listitem>
118 <para>
119 Required patch for processors lacking the <quote>adx</quote>
120 instruction set:
121 <ulink url="&patch-root;/nss-&nss-version;-illegal_instruction-1.patch"/>
122 </para>
123 </listitem>
124-->
125 </itemizedlist>
126
127 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
128
129 <bridgehead renderas="sect4">Required</bridgehead>
130 <para role="required">
131 <xref linkend="nspr"/>
132 </para>
133
134 <bridgehead renderas="sect4">Recommended</bridgehead>
135 <para role="recommended">
136 <xref linkend="sqlite"/> and
137 <xref role="runtime" linkend="p11-kit"/> (runtime)
138 </para>
139
140 <para condition="html" role="usernotes">
141 Editor Notes: <ulink url="&blfs-wiki;/nss"/>
142 </para>
143 </sect2>
144
145 <sect2 role="installation">
146 <title>Installation of NSS</title>
147
148<!--
149 <note>
150 <para>
151 Some old generations processors lack an assembler instruction that
152 is generated unconditionally by NSS-3.90. It leads to an
153 "illegal instruction" fault when running firefox. The availability
154 of this instruction is asserted by the <quote>adx</quote> flag
155 in <filename>/proc/cpuinfo</filename>. If this flag is not set,
156 apply the following patch:
157 </para>
158 </note>
159
160<screen><userinput>grep -q adx /proc/cpuinfo || \
161patch -Np1 -i ../nss-&nss-version;-illegal_instruction-1.patch</userinput></screen>
162
163-->
164 <para>
165 Install <application>NSS</application> by running the following commands:
166 </para>
167
168<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
169
170cd nss &amp;&amp;
171
172make BUILD_OPT=1 \
173 NSPR_INCLUDE_DIR=/usr/include/nspr \
174 USE_SYSTEM_ZLIB=1 \
175 ZLIB_LIBS=-lz \
176 NSS_ENABLE_WERROR=0 \
177 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
178 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
179
180 <para>
181 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
182 To run the tests, execute the following commands<!--(1 test is known to fail)-->:
183 </para>
184
185<screen remap="test"><userinput>cd tests &amp;&amp;
186HOST=localhost DOMSUF=localdomain ./all.sh
187cd ../</userinput></screen>
188
189 <note>
190 <para>Some information about the tests:</para>
191 <itemizedlist spacing="compact">
192 <listitem>
193 <para>
194 HOST=localhost and DOMSUF=localdomain are required.
195 Without these variables, a FQDN is
196 required to be specified and this generic way should work for
197 everyone, provided <systemitem>localhost.localdomain</systemitem>
198 is defined
199 <phrase revision='sysv'>
200 in <filename>/etc/hosts</filename>, as done in
201 <ulink url="&lfs-root;/chapter09/network.html#ch-config-hosts">
202 the LFS book</ulink>.
203 </phrase>
204 <phrase revision='systemd'>
205 by the <systemitem class='library'>myhostname</systemitem>
206 NSS module, as specified in
207 <ulink url="&lfs-root;/chapter08/glibc.html#conf-glibc">
208 the LFS book</ulink>.
209 </phrase>
210 </para>
211 </listitem>
212 <listitem>
213 <para>
214 The tests take a long time to run. If desired there is
215 information in the all.sh script about running subsets of the
216 total test suite.
217 </para>
218 </listitem>
219 <listitem>
220 <para>
221 When interrupting the tests, the test suite
222 fails to spin down test servers that are run. This leads to an
223 infinite loop in the tests where the test suite tries to kill a server
224 that doesn't exist anymore because it pulls the wrong PID.
225 </para>
226 </listitem>
227 <listitem>
228 <para>
229 Test suite results (in HTML format!) can be found at
230 ../../test_results/security/localhost.1/results.html
231 </para>
232 </listitem>
233 <listitem>
234 <para>
235 A few tests might fail on some Intel machines for unknown reasons.
236 </para>
237 </listitem>
238 </itemizedlist>
239 </note>
240
241 <para>
242 Now, as the <systemitem class="username">root</systemitem> user:
243 </para>
244
245<screen role="root"><userinput>cd ../dist &amp;&amp;
246
247install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
248install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
249
250install -v -m755 -d /usr/include/nss &amp;&amp;
251cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
252
253install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
254
255install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
256
257 </sect2>
258
259 <sect2 role="commands">
260 <title>Command Explanations</title>
261
262 <para>
263 <parameter>BUILD_OPT=1</parameter>: This option is passed to
264 <command>make</command> so that the build is performed with no debugging
265 symbols built into the binaries and the default compiler optimizations are
266 used.
267 </para>
268
269 <para>
270 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
271 sets the location of the nspr headers.
272 </para>
273
274 <para>
275 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
276 <command>make</command> to ensure that the
277 <filename class="libraryfile">libssl3.so</filename> library is linked to
278 the system installed <application>zlib</application> instead of the
279 in-tree version.
280 </para>
281
282 <para>
283 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
284 linker flags needed to link to the system <application>zlib</application>.
285 </para>
286
287 <para>
288 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
289 The <parameter>USE_64=1</parameter> option is <emphasis>required on
290 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
291 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
292 has no effect on a 32 bit system.
293 </para>
294
295 <para>
296 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
297 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
298 <application>sqlite</application> is installed and if so it
299 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
300 <command>make</command> so that
301 <filename class="libraryfile">libsoftokn3.so</filename> will link against
302 the system version of sqlite.
303 </para>
304
305 <para>
306 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
307 NSS test suite, append this option to <command>make</command> command,
308 to prevent the compilation of tests and save some build time.
309 </para>
310
311 </sect2>
312
313 <sect2 role="configuration">
314 <title>Configuring NSS</title>
315
316 <para>
317 If <xref linkend="p11-kit"/> is installed, the
318 <application>p11-kit</application> trust module
319 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
320 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
321 transparently make the system CAs available to
322 <application>NSS</application> aware applications, rather than the static
323 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
324 <systemitem class="username">root</systemitem> user, execute the following
325 command:
326 </para>
327
328<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
329
330 <para>
331 Additionally, for dependent applications that do not use the internal
332 database (<filename>/usr/lib/libnssckbi.so</filename>), the
333 <filename>/usr/sbin/make-ca</filename> script included on the
334 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
335 <parameter>-n</parameter> switch, or by modifying the
336 <filename>/etc/make-ca/make-ca.conf</filename> file.
337 </para>
338
339 </sect2>
340
341 <sect2 role="content">
342 <title>Contents</title>
343
344 <segmentedlist>
345 <segtitle>Installed Programs</segtitle>
346 <segtitle>Installed Libraries</segtitle>
347 <segtitle>Installed Directories</segtitle>
348
349 <seglistitem>
350 <seg>
351 certutil, nss-config, and pk12util
352 </seg>
353 <seg>
354 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
355 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
356 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
357 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
358 and libssl3.so
359 </seg>
360 <seg>
361 /usr/include/nss
362 </seg>
363 </seglistitem>
364 </segmentedlist>
365
366 <variablelist>
367 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
368 <?dbfo list-presentation="list"?>
369 <?dbhtml list-presentation="table"?>
370
371 <varlistentry id="certutil">
372 <term><command>certutil</command></term>
373 <listitem>
374 <para>
375 is the Mozilla Certificate Database Tool. It is a command-line
376 utility that can create and modify the Netscape Communicator
377 cert8.db and key3.db database files. It can also list, generate,
378 modify, or delete certificates within the cert8.db file and create
379 or change the password, generate new public and private key pairs,
380 display the contents of the key database, or delete key pairs within
381 the key3.db file
382 </para>
383 <indexterm zone="nss certutil">
384 <primary sortas="b-certutil">certutil</primary>
385 </indexterm>
386 </listitem>
387 </varlistentry>
388
389 <varlistentry id="nss-config">
390 <term><command>nss-config</command></term>
391 <listitem>
392 <para>
393 is used to determine the NSS library settings of the installed NSS
394 libraries
395 </para>
396 <indexterm zone="nss nss-config">
397 <primary sortas="b-nss-config">nss-config</primary>
398 </indexterm>
399 </listitem>
400 </varlistentry>
401
402 <varlistentry id="pk12util">
403 <term><command>pk12util</command></term>
404 <listitem>
405 <para>
406 is a tool for importing certificates and keys from pkcs #12 files
407 into NSS or exporting them. It can also list certificates and keys
408 in such files
409 </para>
410 <indexterm zone="nss pk12util">
411 <primary sortas="b-pk12util">pk12util</primary>
412 </indexterm>
413 </listitem>
414 </varlistentry>
415
416 </variablelist>
417
418 </sect2>
419
420</sect1>
Note: See TracBrowser for help on using the repository browser.