source: postlfs/security/nss.xml@ b9874725

12.1 ken/TL2024 lazarus trunk xry111/llvm18
Last change on this file since b9874725 was ec78b82, checked in by Rahul Chandra <rahul@…>, 4 months ago

Update to nss-3.97
  • Property mode set to 100644
File size: 14.9 KB
Line 
1<?xml version="1.0" encoding="UTF-8"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions-->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14 <!ENTITY nss-download-http "https://&nss-url;/NSS_&nss-dir;_RTM/src/nss-&nss-version;.tar.gz">
15 <!ENTITY nss-download-ftp " ">
16 <!ENTITY nss-md5sum "66da5ddb30ebf742338d4f7f180fb329">
17 <!ENTITY nss-size "74 MB">
18 <!ENTITY nss-buildsize "302 MB (add 146 MB for tests)">
19 <!ENTITY nss-time "1.1 SBU (with parallelism=4, add 16 SBU for tests on AMD Ryzens or at least 30 SBU on Intel machines)">
20 <!-- On my system, I got 64.2 SBU, but Bruce gets 18 SBU. -renodr -->
21 <!-- On my system, I got 63 SBU, but Xi gets ~18 SBU. -pierre (for 3.78) -->
22 <!-- On my 3400G for 3.79 I got 16 SBU -ken -->
23 <!-- Still 17 SBU for 3.81 - bdubbs -->
24 <!-- 73 SBU but I'm on Intel. -renodr -->
25 <!-- 3.86 amended the figures -ken
26 3400G 14 SBU with 6.0.12, but the remeasured SBU has become very slow
27 and maybe other people would see a ster SBU on a fresh build;
28 i7-4790 35 SBU with 6.0.12, no failures
29 Bruce's 3900X 19.3 SBU, his i7-12700K about 30 SBU, 12 failures
30
31 3.93:
32 Passed: 69982
33 Failed: 0
34 Failed with core: 0
35 ASan failures: 0
36 Unknown status: 2
37 TinderboxPrint:Unknown: 2
38 -->
39 <!-- Test Results 3.95: (Intel i9-10900k) I got close to 70 SBU [rahul]
40
41 Passed: 69982
42 Failed: 0
43 Failed with core: 0
44 ASan failures: 0
45 Unknown status: 2
46 TinderboxPrint:Unknown: 2
47 -->
48
49 <!-- Test Results 3.96: (AMD Ryzen 9 3900X) about 14 SBU [bdubbs]
50 Passed: 70289
51 Failed: 0
52 Failed with core: 0
53 ASan failures: 0
54 Unknown status: 2
55 TinderboxPrint:Unknown: 2
56
57
58 -->
59 <!-- Test Results 3.97: (AMD Ryzen 7 1700) about 16 SBU [rahul]
60 Passed: 69809
61 Failed: 0
62 Failed with core: 0
63 ASan failures: 0
64 Unknown status: 2
65 TinderboxPrint:Unknown: 2
66 -->
67
68]>
69
70<sect1 id="nss" xreflabel="nss-&nss-version;">
71 <?dbhtml filename="nss.html"?>
72
73
74 <title>NSS-&nss-version;</title>
75
76 <indexterm zone="nss">
77 <primary sortas="a-NSS">NSS</primary>
78 </indexterm>
79
80 <sect2 role="package">
81 <title>Introduction to NSS</title>
82
83 <para>
84 The Network Security Services (<application>NSS</application>) package is
85 a set of libraries designed to support cross-platform development of
86 security-enabled client and server applications. Applications built with
87 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
88 S/MIME, X.509 v3 certificates, and other security standards. This is
89 useful for implementing SSL and S/MIME or other Internet security
90 standards into an application.
91 </para>
92
93 &lfs120_checked;
94
95 <bridgehead renderas="sect3">Package Information</bridgehead>
96 <itemizedlist spacing="compact">
97 <listitem>
98 <para>
99 Download (HTTP): <ulink url="&nss-download-http;"/>
100 </para>
101 </listitem>
102 <listitem>
103 <para>
104 Download (FTP): <ulink url="&nss-download-ftp;"/>
105 </para>
106 </listitem>
107 <listitem>
108 <para>
109 Download MD5 sum: &nss-md5sum;
110 </para>
111 </listitem>
112 <listitem>
113 <para>
114 Download size: &nss-size;
115 </para>
116 </listitem>
117 <listitem>
118 <para>
119 Estimated disk space required: &nss-buildsize;
120 </para>
121 </listitem>
122 <listitem>
123 <para>
124 Estimated build time: &nss-time;
125 </para>
126 </listitem>
127 </itemizedlist>
128
129 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
130 <itemizedlist spacing="compact">
131 <listitem>
132 <para>
133 Required patch:
134 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
135 </para>
136 </listitem>
137<!--
138 <listitem>
139 <para>
140 Required patch for processors lacking the <quote>adx</quote>
141 instruction set:
142 <ulink url="&patch-root;/nss-&nss-version;-illegal_instruction-1.patch"/>
143 </para>
144 </listitem>
145-->
146 </itemizedlist>
147
148 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
149
150 <bridgehead renderas="sect4">Required</bridgehead>
151 <para role="required">
152 <xref linkend="nspr"/>
153 </para>
154
155 <bridgehead renderas="sect4">Recommended</bridgehead>
156 <para role="recommended">
157 <xref linkend="sqlite"/> and
158 <xref role="runtime" linkend="p11-kit"/> (runtime)
159 </para>
160
161 <para condition="html" role="usernotes">
162 Editor Notes: <ulink url="&blfs-wiki;/nss"/>
163 </para>
164 </sect2>
165
166 <sect2 role="installation">
167 <title>Installation of NSS</title>
168
169<!--
170 <note>
171 <para>
172 Some old generations processors lack an assembler instruction that
173 is generated unconditionally by NSS-3.90. It leads to an
174 "illegal instruction" fault when running firefox. The availability
175 of this instruction is asserted by the <quote>adx</quote> flag
176 in <filename>/proc/cpuinfo</filename>. If this flag is not set,
177 apply the following patch:
178 </para>
179 </note>
180
181<screen><userinput>grep -q adx /proc/cpuinfo || \
182patch -Np1 -i ../nss-&nss-version;-illegal_instruction-1.patch</userinput></screen>
183
184-->
185 <para>
186 Install <application>NSS</application> by running the following commands:
187 </para>
188
189<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
190
191cd nss &amp;&amp;
192
193make BUILD_OPT=1 \
194 NSPR_INCLUDE_DIR=/usr/include/nspr \
195 USE_SYSTEM_ZLIB=1 \
196 ZLIB_LIBS=-lz \
197 NSS_ENABLE_WERROR=0 \
198 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
199 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
200
201 <para>
202 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
203 To run the tests, execute the following commands<!--(1 test is known to fail)-->:
204 </para>
205
206<screen remap="test"><userinput>cd tests &amp;&amp;
207HOST=localhost DOMSUF=localdomain ./all.sh
208cd ../</userinput></screen>
209
210 <note>
211 <para>Some information about the tests:</para>
212 <itemizedlist spacing="compact">
213 <listitem>
214 <para>
215 HOST=localhost and DOMSUF=localdomain are required.
216 Without these variables, a FQDN is
217 required to be specified and this generic way should work for
218 everyone, provided <systemitem>localhost.localdomain</systemitem>
219 is defined
220 <phrase revision='sysv'>
221 in <filename>/etc/hosts</filename>, as done in
222 <ulink url="&lfs-root;/chapter09/network.html#ch-config-hosts">
223 the LFS book</ulink>.
224 </phrase>
225 <phrase revision='systemd'>
226 by the <systemitem class='library'>myhostname</systemitem>
227 Name Service Switch module, as specified in
228 <ulink url="&lfs-root;/chapter08/glibc.html#conf-glibc">
229 the LFS book</ulink>.
230 </phrase>
231 </para>
232 </listitem>
233 <listitem>
234 <para>
235 The tests take a long time to run. If desired there is
236 information in the all.sh script about running subsets of the
237 total test suite.
238 </para>
239 </listitem>
240 <listitem>
241 <para>
242 When interrupting the tests, the test suite
243 fails to spin down test servers that are run. This leads to an
244 infinite loop in the tests where the test suite tries to kill a server
245 that doesn't exist anymore because it pulls the wrong PID.
246 </para>
247 </listitem>
248 <listitem>
249 <para>
250 Test suite results (in HTML format!) can be found at
251 ../../test_results/security/localhost.1/results.html
252 </para>
253 </listitem>
254 <listitem>
255 <para>
256 A few tests might fail on some Intel machines for unknown reasons.
257 </para>
258 </listitem>
259 </itemizedlist>
260 </note>
261
262 <para>
263 Now, as the <systemitem class="username">root</systemitem> user:
264 </para>
265
266<screen role="root"><userinput>cd ../dist &amp;&amp;
267
268install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
269install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
270
271install -v -m755 -d /usr/include/nss &amp;&amp;
272cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
273
274install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
275
276install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
277
278 </sect2>
279
280 <sect2 role="commands">
281 <title>Command Explanations</title>
282
283 <para>
284 <parameter>BUILD_OPT=1</parameter>: This option is passed to
285 <command>make</command> so that the build is performed with no debugging
286 symbols built into the binaries and the default compiler optimizations are
287 used.
288 </para>
289
290 <para>
291 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
292 sets the location of the nspr headers.
293 </para>
294
295 <para>
296 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
297 <command>make</command> to ensure that the
298 <filename class="libraryfile">libssl3.so</filename> library is linked to
299 the system installed <application>zlib</application> instead of the
300 in-tree version.
301 </para>
302
303 <para>
304 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
305 linker flags needed to link to the system <application>zlib</application>.
306 </para>
307
308 <para>
309 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
310 The <parameter>USE_64=1</parameter> option is <emphasis>required on
311 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
312 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
313 has no effect on a 32 bit system.
314 </para>
315
316 <para>
317 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
318 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
319 <application>sqlite</application> is installed and if so it
320 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
321 <command>make</command> so that
322 <filename class="libraryfile">libsoftokn3.so</filename> will link against
323 the system version of sqlite.
324 </para>
325
326 <para>
327 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
328 NSS test suite, append this option to <command>make</command> command,
329 to prevent the compilation of tests and save some build time.
330 </para>
331
332 </sect2>
333
334 <sect2 role="configuration">
335 <title>Configuring NSS</title>
336
337 <para>
338 If <xref linkend="p11-kit"/> is installed, the
339 <application>p11-kit</application> trust module
340 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
341 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
342 transparently make the system CAs available to
343 <application>NSS</application> aware applications, rather than the static
344 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
345 <systemitem class="username">root</systemitem> user, execute the following
346 command:
347 </para>
348
349<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
350
351 <para>
352 Additionally, for dependent applications that do not use the internal
353 database (<filename>/usr/lib/libnssckbi.so</filename>), the
354 <filename>/usr/sbin/make-ca</filename> script included on the
355 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
356 <parameter>-n</parameter> switch, or by modifying the
357 <filename>/etc/make-ca/make-ca.conf</filename> file.
358 </para>
359
360 </sect2>
361
362 <sect2 role="content">
363 <title>Contents</title>
364
365 <segmentedlist>
366 <segtitle>Installed Programs</segtitle>
367 <segtitle>Installed Libraries</segtitle>
368 <segtitle>Installed Directories</segtitle>
369
370 <seglistitem>
371 <seg>
372 certutil, nss-config, and pk12util
373 </seg>
374 <seg>
375 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
376 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
377 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
378 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
379 and libssl3.so
380 </seg>
381 <seg>
382 /usr/include/nss
383 </seg>
384 </seglistitem>
385 </segmentedlist>
386
387 <variablelist>
388 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
389 <?dbfo list-presentation="list"?>
390 <?dbhtml list-presentation="table"?>
391
392 <varlistentry id="certutil">
393 <term><command>certutil</command></term>
394 <listitem>
395 <para>
396 is the Mozilla Certificate Database Tool. It is a command-line
397 utility that can create and modify the Netscape Communicator
398 cert8.db and key3.db database files. It can also list, generate,
399 modify, or delete certificates within the cert8.db file and create
400 or change the password, generate new public and private key pairs,
401 display the contents of the key database, or delete key pairs within
402 the key3.db file
403 </para>
404 <indexterm zone="nss certutil">
405 <primary sortas="b-certutil">certutil</primary>
406 </indexterm>
407 </listitem>
408 </varlistentry>
409
410 <varlistentry id="nss-config">
411 <term><command>nss-config</command></term>
412 <listitem>
413 <para>
414 is used to determine the NSS library settings of the installed NSS
415 libraries
416 </para>
417 <indexterm zone="nss nss-config">
418 <primary sortas="b-nss-config">nss-config</primary>
419 </indexterm>
420 </listitem>
421 </varlistentry>
422
423 <varlistentry id="pk12util">
424 <term><command>pk12util</command></term>
425 <listitem>
426 <para>
427 is a tool for importing certificates and keys from pkcs #12 files
428 into NSS or exporting them. It can also list certificates and keys
429 in such files
430 </para>
431 <indexterm zone="nss pk12util">
432 <primary sortas="b-pk12util">pk12util</primary>
433 </indexterm>
434 </listitem>
435 </varlistentry>
436
437 </variablelist>
438
439 </sect2>
440
441</sect1>
Note: See TracBrowser for help on using the repository browser.