source: postlfs/security/nss.xml@ 9c4595b

10.0 10.1 11.0 ken/refactor-virt lazarus qt5new trunk xry111/git-date xry111/git-date-for-trunk xry111/git-date-test
Last change on this file since 9c4595b was 9c4595b, checked in by Douglas R. Reno <renodr@…>, 16 months ago

Temporarily drop comment about parallelism in nss

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@23336 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 11.9 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "f02eddf6aa8449187e7ffe1c8f470734">
18 <!ENTITY nss-size "77 MB">
19 <!-- 50 MB increase is due to new test files, see #12187 -->
20 <!ENTITY nss-buildsize "292 MB (add 195 MB for tests)">
21 <!ENTITY nss-time "6.6 SBU (add 31 SBU for tests)">
22]>
23
24<sect1 id="nss" xreflabel="NSS-&nss-version;">
25 <?dbhtml filename="nss.html"?>
26
27 <sect1info>
28 <othername>$LastChangedBy$</othername>
29 <date>$Date$</date>
30 </sect1info>
31
32 <title>NSS-&nss-version;</title>
33
34 <indexterm zone="nss">
35 <primary sortas="a-NSS">NSS</primary>
36 </indexterm>
37
38 <sect2 role="package">
39 <title>Introduction to NSS</title>
40
41 <para>
42 The Network Security Services (<application>NSS</application>) package is
43 a set of libraries designed to support cross-platform development of
44 security-enabled client and server applications. Applications built with
45 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
46 S/MIME, X.509 v3 certificates, and other security standards. This is
47 useful for implementing SSL and S/MIME or other Internet security
48 standards into an application.
49 </para>
50
51 &lfs91_checked;
52
53 <bridgehead renderas="sect3">Package Information</bridgehead>
54 <itemizedlist spacing="compact">
55 <listitem>
56 <para>
57 Download (HTTP): <ulink url="&nss-download-http;"/>
58 </para>
59 </listitem>
60 <listitem>
61 <para>
62 Download (FTP): <ulink url="&nss-download-ftp;"/>
63 </para>
64 </listitem>
65 <listitem>
66 <para>
67 Download MD5 sum: &nss-md5sum;
68 </para>
69 </listitem>
70 <listitem>
71 <para>
72 Download size: &nss-size;
73 </para>
74 </listitem>
75 <listitem>
76 <para>
77 Estimated disk space required: &nss-buildsize;
78 </para>
79 </listitem>
80 <listitem>
81 <para>
82 Estimated build time: &nss-time;
83 </para>
84 </listitem>
85 </itemizedlist>
86
87 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
88 <itemizedlist spacing="compact">
89 <listitem>
90 <para>
91 Required patch:
92 <ulink url="&patch-root;/nss-&nss-version;-standalone-2.patch"/>
93 </para>
94 </listitem>
95 </itemizedlist>
96
97 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
98
99 <bridgehead renderas="sect4">Required</bridgehead>
100 <para role="required">
101 <xref linkend="nspr"/>
102 </para>
103
104 <bridgehead renderas="sect4">Recommended</bridgehead>
105 <para role="recommended">
106 <xref linkend="sqlite"/> and
107 <xref role="runtime" linkend="p11-kit"/> (runtime)
108 </para>
109
110 <para condition="html" role="usernotes">
111 User Notes: <ulink url="&blfs-wiki;/nss"/>
112 </para>
113 </sect2>
114
115 <sect2 role="installation">
116 <title>Installation of NSS</title>
117
118 <!-- In 3.53.x, parallel build was possible. See
119 http://lists.linuxfromscratch.org/pipermail/blfs-dev/2020-June/037498.html
120 for more information. -->
121
122 <!-- And with another rebuild of nss-3.54, all is well again
123 <note>
124 <para>
125 This package does not support parallel build.
126 </para>
127 </note>
128 -->
129
130 <para>
131 Install <application>NSS</application> by running the following commands:
132 </para>
133
134<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-2.patch &amp;&amp;
135
136cd nss &amp;&amp;
137
138make BUILD_OPT=1 \
139 NSPR_INCLUDE_DIR=/usr/include/nspr \
140 USE_SYSTEM_ZLIB=1 \
141 ZLIB_LIBS=-lz \
142 NSS_ENABLE_WERROR=0 \
143 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
144 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
145
146 <para>
147 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
148 <!-- The unit tests were run during the build.-->
149 To run the tests, execute the following commands:
150 </para>
151
152<screen remap="test"><userinput>cd tests &amp;&amp;
153HOST=localhost DOMSUF=localdomain ./all.sh &amp;&amp;
154cd ../</userinput></screen>
155
156 <!-- Some information about the tests:
157 - HOST=localhost and DOMSUF=localdomain require the changes done to
158 /etc/hosts in r11892 (LFS). Without these variables, a FQDN is
159 required to specified, and this generic way should work for
160 everyone.
161 - With NSS-3.53, there were 53,866 tests. The tests take an
162 extremely long time to run.
163 - Another interesting discovery has to do with interrupting the tests.
164 It was discovered that, when interrupting the tests, the test suite
165 fails to spin down test servers that are run. This leads to an
166 infinite loop in the tests where the test suite tries to kill a server
167 that doesn't exist anymore because it pulls the wrong PID.
168 - Test suite results (in HTML format!) can be found at
169 ../../test_results/security/localhost.1/
170 -->
171
172 <para>
173 Now, as the <systemitem class="username">root</systemitem> user:
174 </para>
175
176<screen role="root"><userinput>cd ../dist &amp;&amp;
177
178install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
179install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
180
181install -v -m755 -d /usr/include/nss &amp;&amp;
182cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
183chmod -v 644 /usr/include/nss/* &amp;&amp;
184
185install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
186
187install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
188
189 </sect2>
190
191 <sect2 role="commands">
192 <title>Command Explanations</title>
193
194 <para>
195 <parameter>BUILD_OPT=1</parameter>: This option is passed to
196 <command>make</command> so that the build is performed with no debugging
197 symbols built into the binaries and the default compiler optimizations are
198 used.
199 </para>
200
201 <para>
202 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
203 sets the location of the nspr headers.
204 </para>
205
206 <para>
207 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
208 <command>make</command> to ensure that the
209 <filename class="libraryfile">libssl3.so</filename> library is linked to
210 the system installed <application>zlib</application> instead of the
211 in-tree version.
212 </para>
213
214 <para>
215 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
216 linker flags needed to link to the system <application>zlib</application>.
217 </para>
218
219 <para>
220 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
221 The <parameter>USE_64=1</parameter> option is <emphasis>required on
222 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
223 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
224 has no effect on a 32 bit system.
225 </para>
226
227 <para>
228 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
229 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
230 <application>sqlite</application> is installed and if so it
231 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
232 <command>make</command> so that
233 <filename class="libraryfile">libsoftokn3.so</filename> will link against
234 the system version of sqlite.
235 </para>
236
237 </sect2>
238
239 <sect2 role="configuration">
240 <title>Configuring NSS</title>
241
242 <para>
243 If <xref linkend="p11-kit"/> is installed, the
244 <application>p11-kit</application> trust module
245 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
246 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
247 transparently make the system CAs available to
248 <application>NSS</application> aware applications, rather than the static
249 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
250 <systemitem class="username">root</systemitem> user, execute the following
251 commands:
252 </para>
253
254<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
255
256 <para>
257 Additionally, for dependent applications that do not use the internal
258 database (<filename>/usr/lib/libnssckbi.so</filename>), the
259 <filename>/usr/sbin/make-ca</filename> script, included on the
260 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
261 <parameter>-n</parameter> switch, or by modifying the
262 <filename>/etc/make-ca.conf</filename> file.
263 </para>
264
265 </sect2>
266
267 <sect2 role="content">
268 <title>Contents</title>
269
270 <segmentedlist>
271 <segtitle>Installed Programs</segtitle>
272 <segtitle>Installed Libraries</segtitle>
273 <segtitle>Installed Directories</segtitle>
274
275 <seglistitem>
276 <seg>
277 certutil, nss-config, and pk12util
278 </seg>
279 <seg>
280 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
281 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
282 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
283 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
284 and libssl3.so
285 </seg>
286 <seg>
287 /usr/include/nss
288 </seg>
289 </seglistitem>
290 </segmentedlist>
291
292 <variablelist>
293 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
294 <?dbfo list-presentation="list"?>
295 <?dbhtml list-presentation="table"?>
296
297 <varlistentry id="certutil">
298 <term><command>certutil</command></term>
299 <listitem>
300 <para>
301 is the Mozilla Certificate Database Tool. It is a command-line
302 utility that can create and modify the Netscape Communicator
303 cert8.db and key3.db database files. It can also list, generate,
304 modify, or delete certificates within the cert8.db file and create
305 or change the password, generate new public and private key pairs,
306 display the contents of the key database, or delete key pairs within
307 the key3.db file.
308 </para>
309 <indexterm zone="nss certutil">
310 <primary sortas="b-certutil">certutil</primary>
311 </indexterm>
312 </listitem>
313 </varlistentry>
314
315 <varlistentry id="nss-config">
316 <term><command>nss-config</command></term>
317 <listitem>
318 <para>
319 is used to determine the NSS library settings of the installed NSS
320 libraries.
321 </para>
322 <indexterm zone="nss nss-config">
323 <primary sortas="b-nss-config">nss-config</primary>
324 </indexterm>
325 </listitem>
326 </varlistentry>
327
328 <varlistentry id="pk12util">
329 <term><command>pk12util</command></term>
330 <listitem>
331 <para>
332 is a tool for importing certificates and keys from pkcs #12 files
333 into NSS or exporting them. It can also list certificates and keys
334 in such files.
335 </para>
336 <indexterm zone="nss pk12util">
337 <primary sortas="b-pk12util">pk12util</primary>
338 </indexterm>
339 </listitem>
340 </varlistentry>
341
342 </variablelist>
343
344 </sect2>
345
346</sect1>
Note: See TracBrowser for help on using the repository browser.