source: postlfs/security/nss.xml@ b1fc5567

12.1 gimp3 ken/TL2024 lazarus plabs/newcss rahul/power-profiles-daemon trunk xry111/llvm18
Last change on this file since b1fc5567 was 8f45785, checked in by Xi Ruoyao <xry111@…>, 7 months ago

nss: Do not abbreviate "Name Service Switch"

Well, there is a strange coincidence. The package itself is abbreviated
as "NSS" so let's not abbreviate a different thing as "NSS".
  • Property mode set to 100644
File size: 14.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions-->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_&nss-dir;_RTM/src/nss-&nss-version;.tar.gz">
15 <!ENTITY nss-download-ftp " ">
16 <!ENTITY nss-md5sum "d9493377f6ae4f2ffa93b0167db18f5e">
17 <!ENTITY nss-size "73 MB">
18 <!ENTITY nss-buildsize "305 MB (add 148 MB for tests)">
19 <!ENTITY nss-time "1.1 SBU (with parallelism=4, add 14 SBU for tests on AMD Ryzens or at least 30 SBU on Intel machines)">
20 <!-- On my system, I got 64.2 SBU, but Bruce gets 18 SBU. -renodr -->
21 <!-- On my system, I got 63 SBU, but Xi gets ~18 SBU. -pierre (for 3.78) -->
22 <!-- On my 3400G for 3.79 I got 16 SBU -ken -->
23 <!-- Still 17 SBU for 3.81 - bdubbs -->
24 <!-- 73 SBU but I'm on Intel. -renodr -->
25 <!-- 3.86 amended the figures -ken
26 3400G 14 SBU with 6.0.12, but the remeasured SBU has become very slow
27 and maybe other people would see a ster SBU on a fresh build;
28 i7-4790 35 SBU with 6.0.12, no failures
29 Bruce's 3900X 19.3 SBU, his i7-12700K about 30 SBU, 12 failures
30
31 3.93:
32 Passed: 69982
33 Failed: 0
34 Failed with core: 0
35 ASan failures: 0
36 Unknown status: 2
37 TinderboxPrint:Unknown: 2
38 -->
39 <!-- Test Results 3.95: (Intel i9-10900k) I got close to 70 SBU [rahul]
40
41 Passed: 69982
42 Failed: 0
43 Failed with core: 0
44 ASan failures: 0
45 Unknown status: 2
46 TinderboxPrint:Unknown: 2
47 -->
48
49 <!-- Test Results 3.96: (AMD Ryzen 9 3900X) about 14 SBU [bdubbs]
50 Passed: 70289
51 Failed: 0
52 Failed with core: 0
53 ASan failures: 0
54 Unknown status: 2
55 TinderboxPrint:Unknown: 2
56
57
58 -->
59]>
60
61<sect1 id="nss" xreflabel="nss-&nss-version;">
62 <?dbhtml filename="nss.html"?>
63
64
65 <title>NSS-&nss-version;</title>
66
67 <indexterm zone="nss">
68 <primary sortas="a-NSS">NSS</primary>
69 </indexterm>
70
71 <sect2 role="package">
72 <title>Introduction to NSS</title>
73
74 <para>
75 The Network Security Services (<application>NSS</application>) package is
76 a set of libraries designed to support cross-platform development of
77 security-enabled client and server applications. Applications built with
78 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
79 S/MIME, X.509 v3 certificates, and other security standards. This is
80 useful for implementing SSL and S/MIME or other Internet security
81 standards into an application.
82 </para>
83
84 &lfs120_checked;
85
86 <bridgehead renderas="sect3">Package Information</bridgehead>
87 <itemizedlist spacing="compact">
88 <listitem>
89 <para>
90 Download (HTTP): <ulink url="&nss-download-http;"/>
91 </para>
92 </listitem>
93 <listitem>
94 <para>
95 Download (FTP): <ulink url="&nss-download-ftp;"/>
96 </para>
97 </listitem>
98 <listitem>
99 <para>
100 Download MD5 sum: &nss-md5sum;
101 </para>
102 </listitem>
103 <listitem>
104 <para>
105 Download size: &nss-size;
106 </para>
107 </listitem>
108 <listitem>
109 <para>
110 Estimated disk space required: &nss-buildsize;
111 </para>
112 </listitem>
113 <listitem>
114 <para>
115 Estimated build time: &nss-time;
116 </para>
117 </listitem>
118 </itemizedlist>
119
120 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
121 <itemizedlist spacing="compact">
122 <listitem>
123 <para>
124 Required patch:
125 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
126 </para>
127 </listitem>
128<!--
129 <listitem>
130 <para>
131 Required patch for processors lacking the <quote>adx</quote>
132 instruction set:
133 <ulink url="&patch-root;/nss-&nss-version;-illegal_instruction-1.patch"/>
134 </para>
135 </listitem>
136-->
137 </itemizedlist>
138
139 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
140
141 <bridgehead renderas="sect4">Required</bridgehead>
142 <para role="required">
143 <xref linkend="nspr"/>
144 </para>
145
146 <bridgehead renderas="sect4">Recommended</bridgehead>
147 <para role="recommended">
148 <xref linkend="sqlite"/> and
149 <xref role="runtime" linkend="p11-kit"/> (runtime)
150 </para>
151
152 <para condition="html" role="usernotes">
153 Editor Notes: <ulink url="&blfs-wiki;/nss"/>
154 </para>
155 </sect2>
156
157 <sect2 role="installation">
158 <title>Installation of NSS</title>
159
160<!--
161 <note>
162 <para>
163 Some old generations processors lack an assembler instruction that
164 is generated unconditionally by NSS-3.90. It leads to an
165 "illegal instruction" fault when running firefox. The availability
166 of this instruction is asserted by the <quote>adx</quote> flag
167 in <filename>/proc/cpuinfo</filename>. If this flag is not set,
168 apply the following patch:
169 </para>
170 </note>
171
172<screen><userinput>grep -q adx /proc/cpuinfo || \
173patch -Np1 -i ../nss-&nss-version;-illegal_instruction-1.patch</userinput></screen>
174
175-->
176 <para>
177 Install <application>NSS</application> by running the following commands:
178 </para>
179
180<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
181
182cd nss &amp;&amp;
183
184make BUILD_OPT=1 \
185 NSPR_INCLUDE_DIR=/usr/include/nspr \
186 USE_SYSTEM_ZLIB=1 \
187 ZLIB_LIBS=-lz \
188 NSS_ENABLE_WERROR=0 \
189 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
190 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
191
192 <para>
193 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
194 To run the tests, execute the following commands<!--(1 test is known to fail)-->:
195 </para>
196
197<screen remap="test"><userinput>cd tests &amp;&amp;
198HOST=localhost DOMSUF=localdomain ./all.sh
199cd ../</userinput></screen>
200
201 <note>
202 <para>Some information about the tests:</para>
203 <itemizedlist spacing="compact">
204 <listitem>
205 <para>
206 HOST=localhost and DOMSUF=localdomain are required.
207 Without these variables, a FQDN is
208 required to be specified and this generic way should work for
209 everyone, provided <systemitem>localhost.localdomain</systemitem>
210 is defined
211 <phrase revision='sysv'>
212 in <filename>/etc/hosts</filename>, as done in
213 <ulink url="&lfs-root;/chapter09/network.html#ch-config-hosts">
214 the LFS book</ulink>.
215 </phrase>
216 <phrase revision='systemd'>
217 by the <systemitem class='library'>myhostname</systemitem>
218 Name Service Switch module, as specified in
219 <ulink url="&lfs-root;/chapter08/glibc.html#conf-glibc">
220 the LFS book</ulink>.
221 </phrase>
222 </para>
223 </listitem>
224 <listitem>
225 <para>
226 The tests take a long time to run. If desired there is
227 information in the all.sh script about running subsets of the
228 total test suite.
229 </para>
230 </listitem>
231 <listitem>
232 <para>
233 When interrupting the tests, the test suite
234 fails to spin down test servers that are run. This leads to an
235 infinite loop in the tests where the test suite tries to kill a server
236 that doesn't exist anymore because it pulls the wrong PID.
237 </para>
238 </listitem>
239 <listitem>
240 <para>
241 Test suite results (in HTML format!) can be found at
242 ../../test_results/security/localhost.1/results.html
243 </para>
244 </listitem>
245 <listitem>
246 <para>
247 A few tests might fail on some Intel machines for unknown reasons.
248 </para>
249 </listitem>
250 </itemizedlist>
251 </note>
252
253 <para>
254 Now, as the <systemitem class="username">root</systemitem> user:
255 </para>
256
257<screen role="root"><userinput>cd ../dist &amp;&amp;
258
259install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
260install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
261
262install -v -m755 -d /usr/include/nss &amp;&amp;
263cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
264
265install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
266
267install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
268
269 </sect2>
270
271 <sect2 role="commands">
272 <title>Command Explanations</title>
273
274 <para>
275 <parameter>BUILD_OPT=1</parameter>: This option is passed to
276 <command>make</command> so that the build is performed with no debugging
277 symbols built into the binaries and the default compiler optimizations are
278 used.
279 </para>
280
281 <para>
282 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
283 sets the location of the nspr headers.
284 </para>
285
286 <para>
287 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
288 <command>make</command> to ensure that the
289 <filename class="libraryfile">libssl3.so</filename> library is linked to
290 the system installed <application>zlib</application> instead of the
291 in-tree version.
292 </para>
293
294 <para>
295 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
296 linker flags needed to link to the system <application>zlib</application>.
297 </para>
298
299 <para>
300 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
301 The <parameter>USE_64=1</parameter> option is <emphasis>required on
302 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
303 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
304 has no effect on a 32 bit system.
305 </para>
306
307 <para>
308 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
309 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
310 <application>sqlite</application> is installed and if so it
311 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
312 <command>make</command> so that
313 <filename class="libraryfile">libsoftokn3.so</filename> will link against
314 the system version of sqlite.
315 </para>
316
317 <para>
318 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
319 NSS test suite, append this option to <command>make</command> command,
320 to prevent the compilation of tests and save some build time.
321 </para>
322
323 </sect2>
324
325 <sect2 role="configuration">
326 <title>Configuring NSS</title>
327
328 <para>
329 If <xref linkend="p11-kit"/> is installed, the
330 <application>p11-kit</application> trust module
331 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
332 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
333 transparently make the system CAs available to
334 <application>NSS</application> aware applications, rather than the static
335 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
336 <systemitem class="username">root</systemitem> user, execute the following
337 command:
338 </para>
339
340<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
341
342 <para>
343 Additionally, for dependent applications that do not use the internal
344 database (<filename>/usr/lib/libnssckbi.so</filename>), the
345 <filename>/usr/sbin/make-ca</filename> script included on the
346 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
347 <parameter>-n</parameter> switch, or by modifying the
348 <filename>/etc/make-ca/make-ca.conf</filename> file.
349 </para>
350
351 </sect2>
352
353 <sect2 role="content">
354 <title>Contents</title>
355
356 <segmentedlist>
357 <segtitle>Installed Programs</segtitle>
358 <segtitle>Installed Libraries</segtitle>
359 <segtitle>Installed Directories</segtitle>
360
361 <seglistitem>
362 <seg>
363 certutil, nss-config, and pk12util
364 </seg>
365 <seg>
366 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
367 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
368 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
369 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
370 and libssl3.so
371 </seg>
372 <seg>
373 /usr/include/nss
374 </seg>
375 </seglistitem>
376 </segmentedlist>
377
378 <variablelist>
379 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
380 <?dbfo list-presentation="list"?>
381 <?dbhtml list-presentation="table"?>
382
383 <varlistentry id="certutil">
384 <term><command>certutil</command></term>
385 <listitem>
386 <para>
387 is the Mozilla Certificate Database Tool. It is a command-line
388 utility that can create and modify the Netscape Communicator
389 cert8.db and key3.db database files. It can also list, generate,
390 modify, or delete certificates within the cert8.db file and create
391 or change the password, generate new public and private key pairs,
392 display the contents of the key database, or delete key pairs within
393 the key3.db file
394 </para>
395 <indexterm zone="nss certutil">
396 <primary sortas="b-certutil">certutil</primary>
397 </indexterm>
398 </listitem>
399 </varlistentry>
400
401 <varlistentry id="nss-config">
402 <term><command>nss-config</command></term>
403 <listitem>
404 <para>
405 is used to determine the NSS library settings of the installed NSS
406 libraries
407 </para>
408 <indexterm zone="nss nss-config">
409 <primary sortas="b-nss-config">nss-config</primary>
410 </indexterm>
411 </listitem>
412 </varlistentry>
413
414 <varlistentry id="pk12util">
415 <term><command>pk12util</command></term>
416 <listitem>
417 <para>
418 is a tool for importing certificates and keys from pkcs #12 files
419 into NSS or exporting them. It can also list certificates and keys
420 in such files
421 </para>
422 <indexterm zone="nss pk12util">
423 <primary sortas="b-pk12util">pk12util</primary>
424 </indexterm>
425 </listitem>
426 </varlistentry>
427
428 </variablelist>
429
430 </sect2>
431
432</sect1>
Note: See TracBrowser for help on using the repository browser.