source: postlfs/security/nss.xml@ cceceaaf

11.0 11.1 lazarus qt5new trunk upgradedb xry111/intltool xry111/test-20220226
Last change on this file since cceceaaf was cceceaaf, checked in by Douglas R. Reno <renodr@…>, 17 months ago

Update to links-2.22
Update to sqlite-3.35.3
Update to nss-3.63
Update to jasper-2.0.27
Update to pipewire-0.3.24

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@24405 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 12.1 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7<!-- for when .0 is not part of the new tarball name, but always referenced -->
8<!ENTITY nss-url "archive.mozilla.org/pub/security/nss/releases">
9
10<!-- micro versions -->
11<!--<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_&nss-micro-version;_RTM/src/nss-&nss-version;.tar.gz">-->
12
13<!-- no micro versions -->
14<!ENTITY nss-download-http "https://&nss-url;/NSS_3_&nss-minor-version;_RTM/src/nss-&nss-version;.tar.gz">
15
16 <!ENTITY nss-download-ftp " ">
17 <!ENTITY nss-md5sum "0249fc462d8b0ec716965919db86ecce">
18 <!ENTITY nss-size "78 MB">
19 <!ENTITY nss-buildsize "307 MB (add 164 MB for tests)">
20 <!ENTITY nss-time "2.7 SBU (with parallelism=4, add 23 SBU for tests)">
21]>
22
23<sect1 id="nss" xreflabel="NSS-&nss-version;">
24 <?dbhtml filename="nss.html"?>
25
26 <sect1info>
27 <othername>$LastChangedBy$</othername>
28 <date>$Date$</date>
29 </sect1info>
30
31 <title>NSS-&nss-version;</title>
32
33 <indexterm zone="nss">
34 <primary sortas="a-NSS">NSS</primary>
35 </indexterm>
36
37 <sect2 role="package">
38 <title>Introduction to NSS</title>
39
40 <para>
41 The Network Security Services (<application>NSS</application>) package is
42 a set of libraries designed to support cross-platform development of
43 security-enabled client and server applications. Applications built with
44 NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12,
45 S/MIME, X.509 v3 certificates, and other security standards. This is
46 useful for implementing SSL and S/MIME or other Internet security
47 standards into an application.
48 </para>
49
50 &lfs101_checked;
51
52 <bridgehead renderas="sect3">Package Information</bridgehead>
53 <itemizedlist spacing="compact">
54 <listitem>
55 <para>
56 Download (HTTP): <ulink url="&nss-download-http;"/>
57 </para>
58 </listitem>
59 <listitem>
60 <para>
61 Download (FTP): <ulink url="&nss-download-ftp;"/>
62 </para>
63 </listitem>
64 <listitem>
65 <para>
66 Download MD5 sum: &nss-md5sum;
67 </para>
68 </listitem>
69 <listitem>
70 <para>
71 Download size: &nss-size;
72 </para>
73 </listitem>
74 <listitem>
75 <para>
76 Estimated disk space required: &nss-buildsize;
77 </para>
78 </listitem>
79 <listitem>
80 <para>
81 Estimated build time: &nss-time;
82 </para>
83 </listitem>
84 </itemizedlist>
85
86 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
87 <itemizedlist spacing="compact">
88 <listitem>
89 <para>
90 Required patch:
91 <ulink url="&patch-root;/nss-&nss-version;-standalone-1.patch"/>
92 </para>
93 </listitem>
94 </itemizedlist>
95
96 <bridgehead renderas="sect3">NSS Dependencies</bridgehead>
97
98 <bridgehead renderas="sect4">Required</bridgehead>
99 <para role="required">
100 <xref linkend="nspr"/>
101 </para>
102
103 <bridgehead renderas="sect4">Recommended</bridgehead>
104 <para role="recommended">
105 <xref linkend="sqlite"/> and
106 <xref role="runtime" linkend="p11-kit"/> (runtime)
107 </para>
108
109 <para condition="html" role="usernotes">
110 User Notes: <ulink url="&blfs-wiki;/nss"/>
111 </para>
112 </sect2>
113
114 <sect2 role="installation">
115 <title>Installation of NSS</title>
116
117 <!-- In 3.53.x, parallel build was possible. See
118 http://lists.linuxfromscratch.org/pipermail/blfs-dev/2020-June/037498.html
119 for more information. -->
120
121 <!-- And with another rebuild of nss-3.54, all is well again, but broken in 3.60 -->
122 <!-- fixed again in 3.62
123 <note>
124 <para>
125 This package does not support parallel build.
126 </para>
127 </note>-->
128
129 <para>
130 Install <application>NSS</application> by running the following commands:
131 </para>
132
133<screen><userinput>patch -Np1 -i ../nss-&nss-version;-standalone-1.patch &amp;&amp;
134
135cd nss &amp;&amp;
136
137make BUILD_OPT=1 \
138 NSPR_INCLUDE_DIR=/usr/include/nspr \
139 USE_SYSTEM_ZLIB=1 \
140 ZLIB_LIBS=-lz \
141 NSS_ENABLE_WERROR=0 \
142 $([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1) \
143 $([ -f /usr/include/sqlite3.h ] &amp;&amp; echo NSS_USE_SYSTEM_SQLITE=1)</userinput></screen>
144
145 <para>
146 <!-- the unittest files get compiled automatically since nss-3.31.0 -->
147 To run the tests, execute the following commands (1 test is known to fail):
148 </para>
149
150<screen remap="test"><userinput>cd tests &amp;&amp;
151HOST=localhost DOMSUF=localdomain ./all.sh &amp;&amp;
152cd ../</userinput></screen>
153
154 <!-- Some information about the tests:
155 - HOST=localhost and DOMSUF=localdomain require the changes done to
156 /etc/hosts in r11892 (LFS). Without these variables, a FQDN is
157 required to specified, and this generic way should work for
158 everyone.
159 - With NSS-3.53, there were 53,866 tests. The tests take an
160 extremely long time to run.
161 - Another interesting discovery has to do with interrupting the tests.
162 It was discovered that, when interrupting the tests, the test suite
163 fails to spin down test servers that are run. This leads to an
164 infinite loop in the tests where the test suite tries to kill a server
165 that doesn't exist anymore because it pulls the wrong PID.
166 - Test suite results (in HTML format!) can be found at
167 ../../test_results/security/localhost.1/
168 -->
169
170 <para>
171 Now, as the <systemitem class="username">root</systemitem> user:
172 </para>
173
174<screen role="root"><userinput>cd ../dist &amp;&amp;
175
176install -v -m755 Linux*/lib/*.so /usr/lib &amp;&amp;
177install -v -m644 Linux*/lib/{*.chk,libcrmf.a} /usr/lib &amp;&amp;
178
179install -v -m755 -d /usr/include/nss &amp;&amp;
180cp -v -RL {public,private}/nss/* /usr/include/nss &amp;&amp;
181chmod -v 644 /usr/include/nss/* &amp;&amp;
182
183install -v -m755 Linux*/bin/{certutil,nss-config,pk12util} /usr/bin &amp;&amp;
184
185install -v -m644 Linux*/lib/pkgconfig/nss.pc /usr/lib/pkgconfig</userinput></screen>
186
187 </sect2>
188
189 <sect2 role="commands">
190 <title>Command Explanations</title>
191
192 <para>
193 <parameter>BUILD_OPT=1</parameter>: This option is passed to
194 <command>make</command> so that the build is performed with no debugging
195 symbols built into the binaries and the default compiler optimizations are
196 used.
197 </para>
198
199 <para>
200 <parameter>NSPR_INCLUDE_DIR=/usr/include/nspr</parameter>: This option
201 sets the location of the nspr headers.
202 </para>
203
204 <para>
205 <parameter>USE_SYSTEM_ZLIB=1</parameter>: This option is passed to
206 <command>make</command> to ensure that the
207 <filename class="libraryfile">libssl3.so</filename> library is linked to
208 the system installed <application>zlib</application> instead of the
209 in-tree version.
210 </para>
211
212 <para>
213 <parameter>ZLIB_LIBS=-lz</parameter>: This option provides the
214 linker flags needed to link to the system <application>zlib</application>.
215 </para>
216
217 <para>
218 <command>$([ $(uname -m) = x86_64 ] &amp;&amp; echo USE_64=1)</command>:
219 The <parameter>USE_64=1</parameter> option is <emphasis>required on
220 x86_64</emphasis>, otherwise <command>make</command> will try (and fail)
221 to create 32-bit objects. The [ $(uname -m) = x86_64 ] test ensures it
222 has no effect on a 32 bit system.
223 </para>
224
225 <para>
226 <command>([ -f /usr/include/sqlite3.h ] &amp;&amp; echo
227 NSS_USE_SYSTEM_SQLITE=1)</command>: This tests if
228 <application>sqlite</application> is installed and if so it
229 <command>echo</command>s the option NSS_USE_SYSTEM_SQLITE=1 to
230 <command>make</command> so that
231 <filename class="libraryfile">libsoftokn3.so</filename> will link against
232 the system version of sqlite.
233 </para>
234
235 <para>
236 <option>NSS_DISABLE_GTESTS=1</option>: If you don't need to run
237 NSS test suite, append this option to <command>make</command> command,
238 to prevent the compilation of tests and save some build time.
239 </para>
240
241 </sect2>
242
243 <sect2 role="configuration">
244 <title>Configuring NSS</title>
245
246 <para>
247 If <xref linkend="p11-kit"/> is installed, the
248 <application>p11-kit</application> trust module
249 (<filename>/usr/lib/pkcs11/p11-kit-trust.so</filename>) can be used as a
250 drop-in replacement for <filename>/usr/lib/libnssckbi.so</filename> to
251 transparently make the system CAs available to
252 <application>NSS</application> aware applications, rather than the static
253 list provided by <filename>/usr/lib/libnssckbi.so</filename>. As the
254 <systemitem class="username">root</systemitem> user, execute the following
255 commands:
256 </para>
257
258<screen role="root"><userinput>ln -sfv ./pkcs11/p11-kit-trust.so /usr/lib/libnssckbi.so</userinput></screen>
259
260 <para>
261 Additionally, for dependent applications that do not use the internal
262 database (<filename>/usr/lib/libnssckbi.so</filename>), the
263 <filename>/usr/sbin/make-ca</filename> script, included on the
264 <xref linkend="make-ca"/> page can generate a system wide NSS DB with the
265 <parameter>-n</parameter> switch, or by modifying the
266 <filename>/etc/make-ca.conf</filename> file.
267 </para>
268
269 </sect2>
270
271 <sect2 role="content">
272 <title>Contents</title>
273
274 <segmentedlist>
275 <segtitle>Installed Programs</segtitle>
276 <segtitle>Installed Libraries</segtitle>
277 <segtitle>Installed Directories</segtitle>
278
279 <seglistitem>
280 <seg>
281 certutil, nss-config, and pk12util
282 </seg>
283 <seg>
284 libcrmf.a, libfreebl3.so, libfreeblpriv3.so,
285 libnss3.so, libnssckbi.so, libnssckbi-testlib.so,
286 libnssdbm3.so, libnsssysinit.so, libnssutil3.so,
287 libpkcs11testmodule.so, libsmime3.so, libsoftokn3.so,
288 and libssl3.so
289 </seg>
290 <seg>
291 /usr/include/nss
292 </seg>
293 </seglistitem>
294 </segmentedlist>
295
296 <variablelist>
297 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
298 <?dbfo list-presentation="list"?>
299 <?dbhtml list-presentation="table"?>
300
301 <varlistentry id="certutil">
302 <term><command>certutil</command></term>
303 <listitem>
304 <para>
305 is the Mozilla Certificate Database Tool. It is a command-line
306 utility that can create and modify the Netscape Communicator
307 cert8.db and key3.db database files. It can also list, generate,
308 modify, or delete certificates within the cert8.db file and create
309 or change the password, generate new public and private key pairs,
310 display the contents of the key database, or delete key pairs within
311 the key3.db file
312 </para>
313 <indexterm zone="nss certutil">
314 <primary sortas="b-certutil">certutil</primary>
315 </indexterm>
316 </listitem>
317 </varlistentry>
318
319 <varlistentry id="nss-config">
320 <term><command>nss-config</command></term>
321 <listitem>
322 <para>
323 is used to determine the NSS library settings of the installed NSS
324 libraries
325 </para>
326 <indexterm zone="nss nss-config">
327 <primary sortas="b-nss-config">nss-config</primary>
328 </indexterm>
329 </listitem>
330 </varlistentry>
331
332 <varlistentry id="pk12util">
333 <term><command>pk12util</command></term>
334 <listitem>
335 <para>
336 is a tool for importing certificates and keys from pkcs #12 files
337 into NSS or exporting them. It can also list certificates and keys
338 in such files
339 </para>
340 <indexterm zone="nss pk12util">
341 <primary sortas="b-pk12util">pk12util</primary>
342 </indexterm>
343 </listitem>
344 </varlistentry>
345
346 </variablelist>
347
348 </sect2>
349
350</sect1>
Note: See TracBrowser for help on using the repository browser.