source: postlfs/security/nss.xml@ 4f09d49

10.0 10.1 11.0 9.1 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 4f09d49 was 4f09d49, checked in by Bruce Dubbs <bdubbs@…>, 2 years ago

Update to gnome-desktop-3.34.3.
Update to curl-7.68.0.
Update to icewm-1.6.4.
Update to node.js-12.14.1.
Update to nss-3.49.

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@22560 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 10.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions
11<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "d0d3727bfde4837621aeed475cc58dad">
18 <!ENTITY nss-size "73 MB">
19 <!-- 50 MB increase is due to new test files, see #12187 -->
20 <!ENTITY nss-buildsize "247 MB">
21 <!ENTITY nss-time "2.9 SBU">
22]>
23
24<sect1 id="nss" xreflabel="NSS-&nss-version;">
25 <?dbhtml filename="nss.html"?>
26
27 <sect1info>
28 <othername>$LastChangedBy$</othername>
29 <date>$Date$</date>
30 </sect1info>
31
32 <title>NSS-&nss-version;</title>
33
34 <indexterm zone="nss">
35 <primary sortas="a-NSS">NSS</primary>
36 </indexterm>
37
38 <sect2 role="package">
39 <title>Introduction to NSS</title>
40
41 <para>
42 The Network Security Services (<application>NSS</application>) package is
43 a set of libraries designed to support cross-platform development of
44 security-enabled client and server applications. Applications built with
45 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
46 S/MIME, X.509 v3 certificates, and other security standards. This is
47 useful for implementing SSL and S/MIME or other Internet security
48 standards into an application.
49 </para>
50
51 &lfs90_checked;
52
53 <bridgehead renderas="sect3">Package Information</bridgehead>
54 <itemizedlist spacing="compact">
55 <listitem>
56 <para>
57 Download (HTTP): <ulink url="&nss-download-http;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download (FTP): <ulink url="&nss-download-ftp;"/>
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download MD5 sum: &nss-md5sum;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Download size: &nss-size;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated disk space required: &nss-buildsize;
78 </para>
79 </listitem>
80 <listitem>
81 <para>
82 Estimated build time: &nss-time;
83 </para>
84 </listitem>
85 </itemizedlist>
86
87 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
88 <itemizedlist spacing="compact">
89 <listitem>
90 <para>
91 Required patch:
92 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
93 </para>
94 </listitem>
95 </itemizedlist>
96
97 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
98
99 <bridgehead renderas="sect4">Required</bridgehead>
100 <para role="required">
101 <xref linkend="nspr"/>
102 </para>
103
104 <bridgehead renderas="sect4">Recommended</bridgehead>
105 <para role="recommended">
106 <xref linkend="sqlite"/> and
107 <xref role="runtime" linkend="p11-kit"/> (runtime)
108 </para>
109
110 <para condition="html" role="usernotes">
111 User Notes: <ulink url="&blfs-wiki;/nss"/>
112 </para>
113 </sect2>
114
115 <sect2 role="installation">
116 <title>Installation of NSS</title>
117
118 <note>
119 <para>
120 This package does not support parallel build.
121 </para>
122 </note>
123
124 <para>
125 Install <application>NSS</application> by running the following commands:
126 </para>
127
128<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
129
130cd nss &amp;&amp;
131
132make -j1 BUILD_OPT=1 \
133 NSPR_INCLUDE_DIR=/usr/include/nspr \
134 USE_SYSTEM_ZLIB=1 \
135 ZLIB_LIBS=-lz \
136 NSS_ENABLE_WERROR=0 \
137 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
138 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
139
140 <para>
141 The testsuite is designed for testing changes to nss or nspr and is
142 not particularly useful for checking a released version (e.g. it needs
143 to be run on a non-optimized build with both nss and nspr directories
144 existing alongside each other). For further details, see the User Notes.
145 </para>
146
147 <para>
148 Now, as the <systemitem class="username">root</systemitem> user:
149 </para>
150
151<screen role="root"><userinput>cd ../dist &amp;&amp;
152
153install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
154install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
155
156install -v -m755 -d /usr/include/nss &amp;&amp;
157cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
158chmod -v 644 /usr/include/nss/* &amp;&amp;
159
160install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
161
162install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
163
164 </sect2>
165
166 <sect2 role="commands">
167 <title>Command Explanations</title>
168
169 <para>
170 <parameter>BUILD_OPT=1</parameter>: This option is passed to
171 <command>make</command> so that the build is performed with no debugging
172 symbols built into the binaries and the default compiler optimizations are
173 used.
174 </para>
175
176 <para>
177 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
178 sets the location of the nspr headers.
179 </para>
180
181 <para>
182 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
183 <command>make</command> to ensure that the
184 <filename class="libraryfile">libssl3.so</filename> library is linked to
185 the system installed <application>zlib</application> instead of the
186 in-tree version.
187 </para>
188
189 <para>
190 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
191 linker flags needed to link to the system <application>zlib</application>.
192 </para>
193
194 <para>
195 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
196 The <parameter>USE_64=1</parameter> option is <emphasis>required on
197 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
198 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
199 has no effect on a 32 bit system.
200 </para>
201
202 <para>
203 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
204 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
205 <application>sqlite</application> is installed and if so it
206 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
207 <command>make</command> so that
208 <filename class="libraryfile">libsoftokn3.so</filename> will link against
209 the system version of sqlite.
210 </para>
211
212 </sect2>
213
214 <sect2 role="configuration">
215 <title>Configuring NSS</title>
216
217 <para>If <xref linkend="p11-kit"/> is installed, the
218 <application>p11-kit</application> trust module
219 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
220 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
221 transparently make the system CAs available to
222 <application>NSS</application> aware applications, rather than the static
223 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
224 <systemitem class="username">root</systemitem> user, execute the following
225 commands:</para>
226
227<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
228
229 <para>Additionally, for dependent applications that do not use the internal
230 database (<filename>/usr/lib/libnssckbi.so</filename>), the
231 <filename>/usr/sbin/make-ca</filename> script, included on the
232 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
233 <parameter>-n</parameter> switch, or by modifying the
234 <filename>/etc/make-ca.conf</filename> file.</para>
235
236 </sect2>
237
238 <sect2 role="content">
239 <title>Contents</title>
240
241 <segmentedlist>
242 <segtitle>Installed Programs</segtitle>
243 <segtitle>Installed Libraries</segtitle>
244 <segtitle>Installed Directories</segtitle>
245
246 <seglistitem>
247 <seg>
248 certutil, nss-config, and pk12util
249 </seg>
250 <seg>
251 libcrmf.a, libfreebl3.so, libfreeblpriv3.so, libgtest1.so,
252 libgtestutil.so, libnss3.so, libnssckbi.so, libnssdbm3.so,
253 libnsssysinit.so, libnssutil3.so, libsmime3.so, libsoftokn3.so,
254 and libssl3.so
255 </seg>
256 <seg>
257 /usr/include/nss
258 </seg>
259 </seglistitem>
260 </segmentedlist>
261
262 <variablelist>
263 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
264 <?dbfo list-presentation="list"?>
265 <?dbhtml list-presentation="table"?>
266
267 <varlistentry id="certutil">
268 <term><command>certutil</command></term>
269 <listitem>
270 <para>
271 is the Mozilla Certificate Database Tool. It is a command-line
272 utility that can create and modify the Netscape Communicator
273 cert8.db and key3.db database files. It can also list, generate,
274 modify, or delete certificates within the cert8.db file and create
275 or change the password, generate new public and private key pairs,
276 display the contents of the key database, or delete key pairs within
277 the key3.db file.
278 </para>
279 <indexterm zone="nss certutil">
280 <primary sortas="b-certutil">certutil</primary>
281 </indexterm>
282 </listitem>
283 </varlistentry>
284
285 <varlistentry id="nss-config">
286 <term><command>nss-config</command></term>
287 <listitem>
288 <para>
289 is used to determine the NSS library settings of the installed NSS
290 libraries.
291 </para>
292 <indexterm zone="nss nss-config">
293 <primary sortas="b-nss-config">nss-config</primary>
294 </indexterm>
295 </listitem>
296 </varlistentry>
297
298 <varlistentry id="pk12util">
299 <term><command>pk12util</command></term>
300 <listitem>
301 <para>
302 is a tool for importing certificates and keys from pkcs #12 files
303 into NSS or exporting them. It can also list certificates and keys
304 in such files.
305 </para>
306 <indexterm zone="nss pk12util">
307 <primary sortas="b-pk12util">pk12util</primary>
308 </indexterm>
309 </listitem>
310 </varlistentry>
311
312 </variablelist>
313
314 </sect2>
315
316</sect1>
Note: See TracBrowser for help on using the repository browser.