source: postlfs/security/nss.xml@ 96e9478

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts lazarus lxqt perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 96e9478 was 96e9478, checked in by Pierre Labastie <pieere@…>, 7 years ago

role="runtime" in postlfs

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@19237 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 10.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8 <!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!-- <!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz"> -->
12
13 <!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "852ceaa553cecd1cba968ed8b603a26a">
18 <!ENTITY nss-size "9.1 MB">
19 <!ENTITY nss-buildsize "107 MB">
20 <!ENTITY nss-time "1.6 SBU">
21]>
22
23<sect1 id="nss" xreflabel="NSS-&nss-version;">
24 <?dbhtml filename="nss.html"?>
25
26 <sect1info>
27 <othername>$LastChangedBy$</othername>
28 <date>$Date$</date>
29 </sect1info>
30
31 <title>NSS-&nss-version;</title>
32
33 <indexterm zone="nss">
34 <primary sortas="a-NSS">NSS</primary>
35 </indexterm>
36
37 <sect2 role="package">
38 <title>Introduction to NSS</title>
39
40 <para>
41 The Network Security Services (<application>NSS</application>) package is
42 a set of libraries designed to support cross-platform development of
43 security-enabled client and server applications. Applications built with
44 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
45 S/MIME, X.509 v3 certificates, and other security standards. This is
46 useful for implementing SSL and S/MIME or other Internet security
47 standards into an application.
48 </para>
49
50 &lfs81_checked;
51
52 <bridgehead renderas="sect3">Package Information</bridgehead>
53 <itemizedlist spacing="compact">
54 <listitem>
55 <para>
56 Download (HTTP): <ulink url="&nss-download-http;"/>
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download (FTP): <ulink url="&nss-download-ftp;"/>
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Download MD5 sum: &nss-md5sum;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Download size: &nss-size;
72 </para>
73 </listitem>
74 <listitem>
75 <para>
76 Estimated disk space required: &nss-buildsize;
77 </para>
78 </listitem>
79 <listitem>
80 <para>
81 Estimated build time: &nss-time;
82 </para>
83 </listitem>
84 </itemizedlist>
85
86 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
87 <itemizedlist spacing="compact">
88 <listitem>
89 <para>
90 Required patch:
91 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
92 </para>
93 </listitem>
94 </itemizedlist>
95
96 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
97
98 <bridgehead renderas="sect4">Required</bridgehead>
99 <para role="required">
100 <xref linkend="nspr"/>
101 </para>
102
103 <bridgehead renderas="sect4">Recommended</bridgehead>
104 <para role="recommended">
105 <xref linkend="sqlite"/> and
106 <xref role="runtime" linkend="p11-kit"/> (runtime)
107 </para>
108
109 <para condition="html" role="usernotes">
110 User Notes: <ulink url="&blfs-wiki;/nss"/>
111 </para>
112 </sect2>
113
114 <sect2 role="installation">
115 <title>Installation of NSS</title>
116
117 <note>
118 <para>
119 This package does not support parallel build.
120 </para>
121 </note>
122
123 <para>
124 Install <application>NSS</application> by running the following commands:
125 </para>
126
127<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
128
129cd nss &amp;&amp;
130
131make -j1 BUILD_OPT=1 \
132 NSPR_INCLUDE_DIR=/usr/include/nspr \
133 USE_SYSTEM_ZLIB=1 \
134 ZLIB_LIBS=-lz \
135 NSS_ENABLE_WERROR=0 \
136 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
137 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
138
139 <para>
140 This package does not come with a test suite.
141 </para>
142
143 <para>
144 Now, as the <systemitem class="username">root</systemitem> user:
145 </para>
146
147<screen role="root"><userinput>cd ../dist &amp;&amp;
148
149install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
150install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
151
152install -v -m755 -d /usr/include/nss &amp;&amp;
153cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
154chmod -v 644 /usr/include/nss/* &amp;&amp;
155
156install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
157
158install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
159
160 </sect2>
161
162 <sect2 role="commands">
163 <title>Command Explanations</title>
164
165 <para>
166 <parameter>BUILD_OPT=1</parameter>: This option is passed to
167 <command>make</command> so that the build is performed with no debugging
168 symbols built into the binaries and the default compiler optimizations are
169 used.
170 </para>
171
172 <para>
173 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
174 sets the location of the nspr headers.
175 </para>
176
177 <para>
178 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
179 <command>make</command> to ensure that the
180 <filename class="libraryfile">libssl3.so</filename> library is linked to
181 the system installed <application>zlib</application> instead of the
182 in-tree version.
183 </para>
184
185 <para>
186 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
187 linker flags needed to link to the system <application>zlib</application>.
188 </para>
189
190 <para>
191 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
192 The <parameter>USE_64=1</parameter> option is <emphasis>required on
193 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
194 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
195 has no effect on a 32 bit system.
196 </para>
197
198 <para>
199 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
200 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
201 <application>sqlite</application> is installed and if so it
202 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
203 <command>make</command> so that
204 <filename class="libraryfile">libsoftokn3.so</filename> will link against
205 the system version of sqlite.
206 </para>
207
208 </sect2>
209
210 <sect2 role="configuration">
211 <title>Configuring NSS</title>
212
213 <para>If <xref linkend="p11-kit"/> is installed, the
214 <application>p11-kit</application> trust module
215 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
216 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
217 transparently make the system CAs available to
218 <application>NSS</application> aware applications, rather than the static
219 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
220 <systemitem class="username">root</systemitem> user, execute the following
221 commands:</para>
222
223<screen role="root"><userinput>if [ -e /usr/lib/libp11-kit.so ]; then
224 readlink /usr/lib/libnssckbi.so ||
225 rm -v /usr/lib/libnssckbi.so &amp;&amp;
226 ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so
227fi</userinput></screen>
228
229 <para>Additionally, for dependent applications that do not use the internal
230 database (<filename>/usr/lib/libnssckbi.so</filename>), the
231 <filename>make-ca.sh</filename> script, included on the
232 <xref linkend="cacerts"/> page, will generate a system wide NSS DB.</para>
233
234 </sect2>
235
236 <sect2 role="content">
237 <title>Contents</title>
238
239 <segmentedlist>
240 <segtitle>Installed Programs</segtitle>
241 <segtitle>Installed Libraries</segtitle>
242 <segtitle>Installed Directories</segtitle>
243
244 <seglistitem>
245 <seg>
246 certutil, nss-config, and pk12util
247 </seg>
248 <seg>
249 libcrmf.a, libfreebl3.so, libfreeblpriv3.so, libgtest1.so, libnss3.so,
250 libnssckbi.so, libnssdbm3.so, libnsssysinit.so,
251 libnssutil3.so, libsmime3.so, libsoftokn3.so, and libssl3.so
252 </seg>
253 <seg>
254 /usr/include/nss
255 </seg>
256 </seglistitem>
257 </segmentedlist>
258
259 <variablelist>
260 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
261 <?dbfo list-presentation="list"?>
262 <?dbhtml list-presentation="table"?>
263
264 <varlistentry id="certutil">
265 <term><command>certutil</command></term>
266 <listitem>
267 <para>
268 is the Mozilla Certificate Database Tool. It is a command-line
269 utility that can create and modify the Netscape Communicator
270 cert8.db and key3.db database files. It can also list, generate,
271 modify, or delete certificates within the cert8.db file and create
272 or change the password, generate new public and private key pairs,
273 display the contents of the key database, or delete key pairs within
274 the key3.db file.
275 </para>
276 <indexterm zone="nss certutil">
277 <primary sortas="b-certutil">certutil</primary>
278 </indexterm>
279 </listitem>
280 </varlistentry>
281
282 <varlistentry id="nss-config">
283 <term><command>nss-config</command></term>
284 <listitem>
285 <para>
286 is used to determine the NSS library settings of the installed NSS
287 libraries.
288 </para>
289 <indexterm zone="nss nss-config">
290 <primary sortas="b-nss-config">nss-config</primary>
291 </indexterm>
292 </listitem>
293 </varlistentry>
294
295 <varlistentry id="pk12util">
296 <term><command>pk12util</command></term>
297 <listitem>
298 <para>
299 is a tool for importing certificates and keys from pkcs #12 files
300 into NSS or exporting them. It can also list certificates and keys
301 in such files.
302 </para>
303 <indexterm zone="nss pk12util">
304 <primary sortas="b-pk12util">pk12util</primary>
305 </indexterm>
306 </listitem>
307 </varlistentry>
308
309 </variablelist>
310
311 </sect2>
312
313</sect1>
Note: See TracBrowser for help on using the repository browser.