source: postlfs/security/nss.xml@ 4fbf538

10.0 10.1 11.0 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 4fbf538 was 4fbf538, checked in by Ken Moffat <ken@…>, 16 months ago

nss: Update the patch to require nspr >= 4.26

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23335 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 11.8 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "f02eddf6aa8449187e7ffe1c8f470734">
18 <!ENTITY nss-size "77 MB">
19 <!-- 50 MB increase is due to new test files, see #12187 -->
20 <!ENTITY nss-buildsize "292 MB (add 195 MB for tests)">
21 <!ENTITY nss-time "6.6 SBU (add 31 SBU for tests)">
22]>
23
24<sect1 id="nss" xreflabel="NSS-&nss-version;">
25 <?dbhtml filename="nss.html"?>
26
27 <sect1info>
28 <othername>$LastChangedBy$</othername>
29 <date>$Date$</date>
30 </sect1info>
31
32 <title>NSS-&nss-version;</title>
33
34 <indexterm zone="nss">
35 <primary sortas="a-NSS">NSS</primary>
36 </indexterm>
37
38 <sect2 role="package">
39 <title>Introduction to NSS</title>
40
41 <para>
42 The Network Security Services (<application>NSS</application>) package is
43 a set of libraries designed to support cross-platform development of
44 security-enabled client and server applications. Applications built with
45 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
46 S/MIME, X.509 v3 certificates, and other security standards. This is
47 useful for implementing SSL and S/MIME or other Internet security
48 standards into an application.
49 </para>
50
51 &lfs91_checked;
52
53 <bridgehead renderas="sect3">Package Information</bridgehead>
54 <itemizedlist spacing="compact">
55 <listitem>
56 <para>
57 Download (HTTP): <ulink url="&nss-download-http;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download (FTP): <ulink url="&nss-download-ftp;"/>
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download MD5 sum: &nss-md5sum;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Download size: &nss-size;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated disk space required: &nss-buildsize;
78 </para>
79 </listitem>
80 <listitem>
81 <para>
82 Estimated build time: &nss-time;
83 </para>
84 </listitem>
85 </itemizedlist>
86
87 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
88 <itemizedlist spacing="compact">
89 <listitem>
90 <para>
91 Required patch:
92 <ulink url="&patch-root;/nss-&nss-version;-standalone-2.patch"/>
93 </para>
94 </listitem>
95 </itemizedlist>
96
97 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
98
99 <bridgehead renderas="sect4">Required</bridgehead>
100 <para role="required">
101 <xref linkend="nspr"/>
102 </para>
103
104 <bridgehead renderas="sect4">Recommended</bridgehead>
105 <para role="recommended">
106 <xref linkend="sqlite"/> and
107 <xref role="runtime" linkend="p11-kit"/> (runtime)
108 </para>
109
110 <para condition="html" role="usernotes">
111 User Notes: <ulink url="&blfs-wiki;/nss"/>
112 </para>
113 </sect2>
114
115 <sect2 role="installation">
116 <title>Installation of NSS</title>
117
118 <!-- In 3.53.x, parallel build was possible. See
119 http://lists.linuxfromscratch.org/pipermail/blfs-dev/2020-June/037498.html
120 for more information. -->
121
122 <note>
123 <para>
124 This package does not support parallel build.
125 </para>
126 </note>
127
128 <para>
129 Install <application>NSS</application> by running the following commands:
130 </para>
131
132<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-2.patch &amp;&amp;
133
134cd nss &amp;&amp;
135
136make BUILD_OPT=1 \
137 NSPR_INCLUDE_DIR=/usr/include/nspr \
138 USE_SYSTEM_ZLIB=1 \
139 ZLIB_LIBS=-lz \
140 NSS_ENABLE_WERROR=0 \
141 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
142 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
143
144 <para>
145 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
146 <!-- The unit tests were run during the build.-->
147 To run the tests, execute the following commands:
148 </para>
149
150<screen remap="test"><userinput>cd tests &amp;&amp;
151HOST=localhost DOMSUF=localdomain ./all.sh &amp;&amp;
152cd ../</userinput></screen>
153
154 <!-- Some information about the tests:
155 - HOST=localhost and DOMSUF=localdomain require the changes done to
156 /etc/hosts in r11892 (LFS). Without these variables, a FQDN is
157 required to specified, and this generic way should work for
158 everyone.
159 - With NSS-3.53, there were 53,866 tests. The tests take an
160 extremely long time to run.
161 - Another interesting discovery has to do with interrupting the tests.
162 It was discovered that, when interrupting the tests, the test suite
163 fails to spin down test servers that are run. This leads to an
164 infinite loop in the tests where the test suite tries to kill a server
165 that doesn't exist anymore because it pulls the wrong PID.
166 - Test suite results (in HTML format!) can be found at
167 ../../test_results/security/localhost.1/
168 -->
169
170 <para>
171 Now, as the <systemitem class="username">root</systemitem> user:
172 </para>
173
174<screen role="root"><userinput>cd ../dist &amp;&amp;
175
176install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
177install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
178
179install -v -m755 -d /usr/include/nss &amp;&amp;
180cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
181chmod -v 644 /usr/include/nss/* &amp;&amp;
182
183install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
184
185install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
186
187 </sect2>
188
189 <sect2 role="commands">
190 <title>Command Explanations</title>
191
192 <para>
193 <parameter>BUILD_OPT=1</parameter>: This option is passed to
194 <command>make</command> so that the build is performed with no debugging
195 symbols built into the binaries and the default compiler optimizations are
196 used.
197 </para>
198
199 <para>
200 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
201 sets the location of the nspr headers.
202 </para>
203
204 <para>
205 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
206 <command>make</command> to ensure that the
207 <filename class="libraryfile">libssl3.so</filename> library is linked to
208 the system installed <application>zlib</application> instead of the
209 in-tree version.
210 </para>
211
212 <para>
213 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
214 linker flags needed to link to the system <application>zlib</application>.
215 </para>
216
217 <para>
218 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
219 The <parameter>USE_64=1</parameter> option is <emphasis>required on
220 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
221 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
222 has no effect on a 32 bit system.
223 </para>
224
225 <para>
226 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
227 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
228 <application>sqlite</application> is installed and if so it
229 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
230 <command>make</command> so that
231 <filename class="libraryfile">libsoftokn3.so</filename> will link against
232 the system version of sqlite.
233 </para>
234
235 </sect2>
236
237 <sect2 role="configuration">
238 <title>Configuring NSS</title>
239
240 <para>
241 If <xref linkend="p11-kit"/> is installed, the
242 <application>p11-kit</application> trust module
243 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
244 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
245 transparently make the system CAs available to
246 <application>NSS</application> aware applications, rather than the static
247 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
248 <systemitem class="username">root</systemitem> user, execute the following
249 commands:
250 </para>
251
252<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
253
254 <para>
255 Additionally, for dependent applications that do not use the internal
256 database (<filename>/usr/lib/libnssckbi.so</filename>), the
257 <filename>/usr/sbin/make-ca</filename> script, included on the
258 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
259 <parameter>-n</parameter> switch, or by modifying the
260 <filename>/etc/make-ca.conf</filename> file.
261 </para>
262
263 </sect2>
264
265 <sect2 role="content">
266 <title>Contents</title>
267
268 <segmentedlist>
269 <segtitle>Installed Programs</segtitle>
270 <segtitle>Installed Libraries</segtitle>
271 <segtitle>Installed Directories</segtitle>
272
273 <seglistitem>
274 <seg>
275 certutil, nss-config, and pk12util
276 </seg>
277 <seg>
278 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
279 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
280 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
281 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
282 and libssl3.so
283 </seg>
284 <seg>
285 /usr/include/nss
286 </seg>
287 </seglistitem>
288 </segmentedlist>
289
290 <variablelist>
291 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
292 <?dbfo list-presentation="list"?>
293 <?dbhtml list-presentation="table"?>
294
295 <varlistentry id="certutil">
296 <term><command>certutil</command></term>
297 <listitem>
298 <para>
299 is the Mozilla Certificate Database Tool. It is a command-line
300 utility that can create and modify the Netscape Communicator
301 cert8.db and key3.db database files. It can also list, generate,
302 modify, or delete certificates within the cert8.db file and create
303 or change the password, generate new public and private key pairs,
304 display the contents of the key database, or delete key pairs within
305 the key3.db file.
306 </para>
307 <indexterm zone="nss certutil">
308 <primary sortas="b-certutil">certutil</primary>
309 </indexterm>
310 </listitem>
311 </varlistentry>
312
313 <varlistentry id="nss-config">
314 <term><command>nss-config</command></term>
315 <listitem>
316 <para>
317 is used to determine the NSS library settings of the installed NSS
318 libraries.
319 </para>
320 <indexterm zone="nss nss-config">
321 <primary sortas="b-nss-config">nss-config</primary>
322 </indexterm>
323 </listitem>
324 </varlistentry>
325
326 <varlistentry id="pk12util">
327 <term><command>pk12util</command></term>
328 <listitem>
329 <para>
330 is a tool for importing certificates and keys from pkcs #12 files
331 into NSS or exporting them. It can also list certificates and keys
332 in such files.
333 </para>
334 <indexterm zone="nss pk12util">
335 <primary sortas="b-pk12util">pk12util</primary>
336 </indexterm>
337 </listitem>
338 </varlistentry>
339
340 </variablelist>
341
342 </sect2>
343
344</sect1>
Note: See TracBrowser for help on using the repository browser.