source: postlfs/security/nss.xml@ c7768882

11.0 ken/refactor-virt lazarus qt5new trunk
Last change on this file since c7768882 was c7768882, checked in by Xi Ruoyao <xry111@…>, 4 months ago

nss: remove a '&&' in nss

The left operand of it is known to fail. If '&&' is used, 'cd ..' won't
be executed at all.

  • Property mode set to 100644
File size: 12.3 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "f2c696c91dcc5170138eaa9c7b5674ab">
18 <!ENTITY nss-size "79 MB">
19 <!ENTITY nss-buildsize "304 MB (add 122 MB for tests)">
20 <!ENTITY nss-time "9.0 SBU (with parallelism=4, add 35 SBU for tests)">
21]>
22
23<sect1 id="nss" xreflabel="NSS-&nss-version;">
24 <?dbhtml filename="nss.html"?>
25
26 <sect1info>
27 <date>$Date$</date>
28 </sect1info>
29
30 <title>NSS-&nss-version;</title>
31
32 <indexterm zone="nss">
33 <primary sortas="a-NSS">NSS</primary>
34 </indexterm>
35
36 <sect2 role="package">
37 <title>Introduction to NSS</title>
38
39 <para>
40 The Network Security Services (<application>NSS</application>) package is
41 a set of libraries designed to support cross-platform development of
42 security-enabled client and server applications. Applications built with
43 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
44 S/MIME, X.509 v3 certificates, and other security standards. This is
45 useful for implementing SSL and S/MIME or other Internet security
46 standards into an application.
47 </para>
48
49 &lfs101_checked;
50
51 <bridgehead renderas="sect3">Package Information</bridgehead>
52 <itemizedlist spacing="compact">
53 <listitem>
54 <para>
55 Download (HTTP): <ulink url="&nss-download-http;"/>
56 </para>
57 </listitem>
58 <listitem>
59 <para>
60 Download (FTP): <ulink url="&nss-download-ftp;"/>
61 </para>
62 </listitem>
63 <listitem>
64 <para>
65 Download MD5 sum: &nss-md5sum;
66 </para>
67 </listitem>
68 <listitem>
69 <para>
70 Download size: &nss-size;
71 </para>
72 </listitem>
73 <listitem>
74 <para>
75 Estimated disk space required: &nss-buildsize;
76 </para>
77 </listitem>
78 <listitem>
79 <para>
80 Estimated build time: &nss-time;
81 </para>
82 </listitem>
83 </itemizedlist>
84
85 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
86 <itemizedlist spacing="compact">
87 <listitem>
88 <para>
89 Required patch:
90 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
91 </para>
92 </listitem>
93 </itemizedlist>
94
95 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
96
97 <bridgehead renderas="sect4">Required</bridgehead>
98 <para role="required">
99 <xref linkend="nspr"/>
100 </para>
101
102 <bridgehead renderas="sect4">Recommended</bridgehead>
103 <para role="recommended">
104 <xref linkend="sqlite"/> and
105 <xref role="runtime" linkend="p11-kit"/> (runtime)
106 </para>
107
108 <para condition="html" role="usernotes">
109 User Notes: <ulink url="&blfs-wiki;/nss"/>
110 </para>
111 </sect2>
112
113 <sect2 role="installation">
114 <title>Installation of NSS</title>
115
116 <!-- In 3.53.x, parallel build was possible. See
117 http://lists.linuxfromscratch.org/pipermail/blfs-dev/2020-June/037498.html
118 for more information. -->
119
120 <!-- And with another rebuild of nss-3.54, all is well again, but broken in 3.60 -->
121 <!-- fixed again in 3.62
122 <note>
123 <para>
124 This package does not support parallel build.
125 </para>
126 </note>-->
127
128 <para>
129 Install <application>NSS</application> by running the following commands:
130 </para>
131
132<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
133
134cd nss &amp;&amp;
135
136make BUILD_OPT=1 \
137 NSPR_INCLUDE_DIR=/usr/include/nspr \
138 USE_SYSTEM_ZLIB=1 \
139 ZLIB_LIBS=-lz \
140 NSS_ENABLE_WERROR=0 \
141 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
142 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
143
144 <para>
145 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
146 To run the tests, execute the following commands (1 test is known to fail):
147 </para>
148
149<screen remap="test"><userinput>cd tests &amp;&amp;
150HOST=localhost DOMSUF=localdomain ./all.sh
151cd ../</userinput></screen>
152
153 <note>
154 <para>Some information about the tests:</para>
155 <itemizedlist spacing="compact">
156 <listitem>
157 <para>
158 HOST=localhost and DOMSUF=localdomain are required
159 Without these variables, a FQDN is
160 required to specified and this generic way should work for
161 everyone.
162 </para>
163 </listitem>
164 <listitem>
165 <para>
166 The tests take an extremely long time to run. If desired there is
167 information in the all.sh script about running subsets of the
168 total test suite.
169 </para>
170 </listitem>
171 <listitem>
172 <para>
173 When interrupting the tests, the test suite
174 fails to spin down test servers that are run. This leads to an
175 infinite loop in the tests where the test suite tries to kill a server
176 that doesn't exist anymore because it pulls the wrong PID.
177 </para>
178 </listitem>
179 <listitem>
180 <para>
181 Test suite results (in HTML format!) can be found at
182 ../../test_results/security/localhost.1/results.html
183 </para>
184 </listitem>
185 </itemizedlist>
186 </note>
187
188 <para>
189 Now, as the <systemitem class="username">root</systemitem> user:
190 </para>
191
192<screen role="root"><userinput>cd ../dist &amp;&amp;
193
194install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
195install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
196
197install -v -m755 -d /usr/include/nss &amp;&amp;
198cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
199chmod -v 644 /usr/include/nss/* &amp;&amp;
200
201install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
202
203install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
204
205 </sect2>
206
207 <sect2 role="commands">
208 <title>Command Explanations</title>
209
210 <para>
211 <parameter>BUILD_OPT=1</parameter>: This option is passed to
212 <command>make</command> so that the build is performed with no debugging
213 symbols built into the binaries and the default compiler optimizations are
214 used.
215 </para>
216
217 <para>
218 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
219 sets the location of the nspr headers.
220 </para>
221
222 <para>
223 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
224 <command>make</command> to ensure that the
225 <filename class="libraryfile">libssl3.so</filename> library is linked to
226 the system installed <application>zlib</application> instead of the
227 in-tree version.
228 </para>
229
230 <para>
231 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
232 linker flags needed to link to the system <application>zlib</application>.
233 </para>
234
235 <para>
236 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
237 The <parameter>USE_64=1</parameter> option is <emphasis>required on
238 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
239 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
240 has no effect on a 32 bit system.
241 </para>
242
243 <para>
244 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
245 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
246 <application>sqlite</application> is installed and if so it
247 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
248 <command>make</command> so that
249 <filename class="libraryfile">libsoftokn3.so</filename> will link against
250 the system version of sqlite.
251 </para>
252
253 <para>
254 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
255 NSS test suite, append this option to <command>make</command> command,
256 to prevent the compilation of tests and save some build time.
257 </para>
258
259 </sect2>
260
261 <sect2 role="configuration">
262 <title>Configuring NSS</title>
263
264 <para>
265 If <xref linkend="p11-kit"/> is installed, the
266 <application>p11-kit</application> trust module
267 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
268 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
269 transparently make the system CAs available to
270 <application>NSS</application> aware applications, rather than the static
271 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
272 <systemitem class="username">root</systemitem> user, execute the following
273 commands:
274 </para>
275
276<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
277
278 <para>
279 Additionally, for dependent applications that do not use the internal
280 database (<filename>/usr/lib/libnssckbi.so</filename>), the
281 <filename>/usr/sbin/make-ca</filename> script, included on the
282 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
283 <parameter>-n</parameter> switch, or by modifying the
284 <filename>/etc/make-ca.conf</filename> file.
285 </para>
286
287 </sect2>
288
289 <sect2 role="content">
290 <title>Contents</title>
291
292 <segmentedlist>
293 <segtitle>Installed Programs</segtitle>
294 <segtitle>Installed Libraries</segtitle>
295 <segtitle>Installed Directories</segtitle>
296
297 <seglistitem>
298 <seg>
299 certutil, nss-config, and pk12util
300 </seg>
301 <seg>
302 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
303 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
304 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
305 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
306 and libssl3.so
307 </seg>
308 <seg>
309 /usr/include/nss
310 </seg>
311 </seglistitem>
312 </segmentedlist>
313
314 <variablelist>
315 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
316 <?dbfo list-presentation="list"?>
317 <?dbhtml list-presentation="table"?>
318
319 <varlistentry id="certutil">
320 <term><command>certutil</command></term>
321 <listitem>
322 <para>
323 is the Mozilla Certificate Database Tool. It is a command-line
324 utility that can create and modify the Netscape Communicator
325 cert8.db and key3.db database files. It can also list, generate,
326 modify, or delete certificates within the cert8.db file and create
327 or change the password, generate new public and private key pairs,
328 display the contents of the key database, or delete key pairs within
329 the key3.db file
330 </para>
331 <indexterm zone="nss certutil">
332 <primary sortas="b-certutil">certutil</primary>
333 </indexterm>
334 </listitem>
335 </varlistentry>
336
337 <varlistentry id="nss-config">
338 <term><command>nss-config</command></term>
339 <listitem>
340 <para>
341 is used to determine the NSS library settings of the installed NSS
342 libraries
343 </para>
344 <indexterm zone="nss nss-config">
345 <primary sortas="b-nss-config">nss-config</primary>
346 </indexterm>
347 </listitem>
348 </varlistentry>
349
350 <varlistentry id="pk12util">
351 <term><command>pk12util</command></term>
352 <listitem>
353 <para>
354 is a tool for importing certificates and keys from pkcs #12 files
355 into NSS or exporting them. It can also list certificates and keys
356 in such files
357 </para>
358 <indexterm zone="nss pk12util">
359 <primary sortas="b-pk12util">pk12util</primary>
360 </indexterm>
361 </listitem>
362 </varlistentry>
363
364 </variablelist>
365
366 </sect2>
367
368</sect1>
Note: See TracBrowser for help on using the repository browser.