source: postlfs/security/nss.xml@ 5ce638b

trunk
Last change on this file since 5ce638b was 5ce638b, checked in by Ken Moffat <ken@…>, 3 months ago

nss-3.64.

  • Property mode set to 100644
File size: 12.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "2b042b68ec53e99f8f91f37c0c842ee3">
18 <!ENTITY nss-size "79 MB">
19 <!ENTITY nss-buildsize "306 MB (add 99 MB for tests)">
20 <!ENTITY nss-time "2.9 SBU (with parallelism=4, add 20 SBU for tests)">
21]>
22
23<sect1 id="nss" xreflabel="NSS-&nss-version;">
24 <?dbhtml filename="nss.html"?>
25
26 <sect1info>
27 <date>$Date$</date>
28 </sect1info>
29
30 <title>NSS-&nss-version;</title>
31
32 <indexterm zone="nss">
33 <primary sortas="a-NSS">NSS</primary>
34 </indexterm>
35
36 <sect2 role="package">
37 <title>Introduction to NSS</title>
38
39 <para>
40 The Network Security Services (<application>NSS</application>) package is
41 a set of libraries designed to support cross-platform development of
42 security-enabled client and server applications. Applications built with
43 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
44 S/MIME, X.509 v3 certificates, and other security standards. This is
45 useful for implementing SSL and S/MIME or other Internet security
46 standards into an application.
47 </para>
48
49 &lfs101_checked;
50
51 <bridgehead renderas="sect3">Package Information</bridgehead>
52 <itemizedlist spacing="compact">
53 <listitem>
54 <para>
55 Download (HTTP): <ulink url="&nss-download-http;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download (FTP): <ulink url="&nss-download-ftp;"/>
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download MD5 sum: &nss-md5sum;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Download size: &nss-size;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated disk space required: &nss-buildsize;
76 </para>
77 </listitem>
78 <listitem>
79 <para>
80 Estimated build time: &nss-time;
81 </para>
82 </listitem>
83 </itemizedlist>
84
85 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
86 <itemizedlist spacing="compact">
87 <listitem>
88 <para>
89 Required patch:
90 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
91 </para>
92 </listitem>
93 </itemizedlist>
94
95 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
96
97 <bridgehead renderas="sect4">Required</bridgehead>
98 <para role="required">
99 <xref linkend="nspr"/>
100 </para>
101
102 <bridgehead renderas="sect4">Recommended</bridgehead>
103 <para role="recommended">
104 <xref linkend="sqlite"/> and
105 <xref role="runtime" linkend="p11-kit"/> (runtime)
106 </para>
107
108 <para condition="html" role="usernotes">
109 User Notes: <ulink url="&blfs-wiki;/nss"/>
110 </para>
111 </sect2>
112
113 <sect2 role="installation">
114 <title>Installation of NSS</title>
115
116 <!-- In 3.53.x, parallel build was possible. See
117 http://lists.linuxfromscratch.org/pipermail/blfs-dev/2020-June/037498.html
118 for more information. -->
119
120 <!-- And with another rebuild of nss-3.54, all is well again, but broken in 3.60 -->
121 <!-- fixed again in 3.62
122 <note>
123 <para>
124 This package does not support parallel build.
125 </para>
126 </note>-->
127
128 <para>
129 Install <application>NSS</application> by running the following commands:
130 </para>
131
132<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
133
134cd nss &amp;&amp;
135
136make BUILD_OPT=1 \
137 NSPR_INCLUDE_DIR=/usr/include/nspr \
138 USE_SYSTEM_ZLIB=1 \
139 ZLIB_LIBS=-lz \
140 NSS_ENABLE_WERROR=0 \
141 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
142 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
143
144 <para>
145 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
146 To run the tests, execute the following commands (1 test is known to fail):
147 </para>
148
149<screen remap="test"><userinput>cd tests &amp;&amp;
150HOST=localhost DOMSUF=localdomain ./all.sh &amp;&amp;
151cd ../</userinput></screen>
152
153 <!-- Some information about the tests:
154 - HOST=localhost and DOMSUF=localdomain require the changes done to
155 /etc/hosts in r11892 (LFS). Without these variables, a FQDN is
156 required to specified, and this generic way should work for
157 everyone.
158 - With NSS-3.53, there were 53,866 tests. The tests take an
159 extremely long time to run.
160 - Another interesting discovery has to do with interrupting the tests.
161 It was discovered that, when interrupting the tests, the test suite
162 fails to spin down test servers that are run. This leads to an
163 infinite loop in the tests where the test suite tries to kill a server
164 that doesn't exist anymore because it pulls the wrong PID.
165 - Test suite results (in HTML format!) can be found at
166 ../../test_results/security/localhost.1/
167 -->
168
169 <para>
170 Now, as the <systemitem class="username">root</systemitem> user:
171 </para>
172
173<screen role="root"><userinput>cd ../dist &amp;&amp;
174
175install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
176install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
177
178install -v -m755 -d /usr/include/nss &amp;&amp;
179cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
180chmod -v 644 /usr/include/nss/* &amp;&amp;
181
182install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
183
184install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
185
186 </sect2>
187
188 <sect2 role="commands">
189 <title>Command Explanations</title>
190
191 <para>
192 <parameter>BUILD_OPT=1</parameter>: This option is passed to
193 <command>make</command> so that the build is performed with no debugging
194 symbols built into the binaries and the default compiler optimizations are
195 used.
196 </para>
197
198 <para>
199 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
200 sets the location of the nspr headers.
201 </para>
202
203 <para>
204 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
205 <command>make</command> to ensure that the
206 <filename class="libraryfile">libssl3.so</filename> library is linked to
207 the system installed <application>zlib</application> instead of the
208 in-tree version.
209 </para>
210
211 <para>
212 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
213 linker flags needed to link to the system <application>zlib</application>.
214 </para>
215
216 <para>
217 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
218 The <parameter>USE_64=1</parameter> option is <emphasis>required on
219 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
220 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
221 has no effect on a 32 bit system.
222 </para>
223
224 <para>
225 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
226 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
227 <application>sqlite</application> is installed and if so it
228 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
229 <command>make</command> so that
230 <filename class="libraryfile">libsoftokn3.so</filename> will link against
231 the system version of sqlite.
232 </para>
233
234 <para>
235 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
236 NSS test suite, append this option to <command>make</command> command,
237 to prevent the compilation of tests and save some build time.
238 </para>
239
240 </sect2>
241
242 <sect2 role="configuration">
243 <title>Configuring NSS</title>
244
245 <para>
246 If <xref linkend="p11-kit"/> is installed, the
247 <application>p11-kit</application> trust module
248 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
249 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
250 transparently make the system CAs available to
251 <application>NSS</application> aware applications, rather than the static
252 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
253 <systemitem class="username">root</systemitem> user, execute the following
254 commands:
255 </para>
256
257<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
258
259 <para>
260 Additionally, for dependent applications that do not use the internal
261 database (<filename>/usr/lib/libnssckbi.so</filename>), the
262 <filename>/usr/sbin/make-ca</filename> script, included on the
263 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
264 <parameter>-n</parameter> switch, or by modifying the
265 <filename>/etc/make-ca.conf</filename> file.
266 </para>
267
268 </sect2>
269
270 <sect2 role="content">
271 <title>Contents</title>
272
273 <segmentedlist>
274 <segtitle>Installed Programs</segtitle>
275 <segtitle>Installed Libraries</segtitle>
276 <segtitle>Installed Directories</segtitle>
277
278 <seglistitem>
279 <seg>
280 certutil, nss-config, and pk12util
281 </seg>
282 <seg>
283 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
284 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
285 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
286 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
287 and libssl3.so
288 </seg>
289 <seg>
290 /usr/include/nss
291 </seg>
292 </seglistitem>
293 </segmentedlist>
294
295 <variablelist>
296 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
297 <?dbfo list-presentation="list"?>
298 <?dbhtml list-presentation="table"?>
299
300 <varlistentry id="certutil">
301 <term><command>certutil</command></term>
302 <listitem>
303 <para>
304 is the Mozilla Certificate Database Tool. It is a command-line
305 utility that can create and modify the Netscape Communicator
306 cert8.db and key3.db database files. It can also list, generate,
307 modify, or delete certificates within the cert8.db file and create
308 or change the password, generate new public and private key pairs,
309 display the contents of the key database, or delete key pairs within
310 the key3.db file
311 </para>
312 <indexterm zone="nss certutil">
313 <primary sortas="b-certutil">certutil</primary>
314 </indexterm>
315 </listitem>
316 </varlistentry>
317
318 <varlistentry id="nss-config">
319 <term><command>nss-config</command></term>
320 <listitem>
321 <para>
322 is used to determine the NSS library settings of the installed NSS
323 libraries
324 </para>
325 <indexterm zone="nss nss-config">
326 <primary sortas="b-nss-config">nss-config</primary>
327 </indexterm>
328 </listitem>
329 </varlistentry>
330
331 <varlistentry id="pk12util">
332 <term><command>pk12util</command></term>
333 <listitem>
334 <para>
335 is a tool for importing certificates and keys from pkcs #12 files
336 into NSS or exporting them. It can also list certificates and keys
337 in such files
338 </para>
339 <indexterm zone="nss pk12util">
340 <primary sortas="b-pk12util">pk12util</primary>
341 </indexterm>
342 </listitem>
343 </varlistentry>
344
345 </variablelist>
346
347 </sect2>
348
349</sect1>
Note: See TracBrowser for help on using the repository browser.