%global nspr_version 4.10.8

%global nss_name nss

%global nss_util_version 3.21.0

%global nss_util_build -2.2

%global unsupported_tools_directory %{_libdir}/nss/unsupported-tools

%global saved_files_dir %{_libdir}/nss/saved

%global prelink_conf_dir %{_sysconfdir}/prelink.conf.d/

%define dracutlibdir %{_prefix}/lib/dracut

%global dracut_modules_dir %{dracutlibdir}/modules.d/05nss-softokn/

%global dracut_conf_dir %{dracutlibdir}/dracut.conf.d

# Produce .chk files for the final stripped binaries

#

# NOTE: The LD_LIBRARY_PATH line guarantees shlibsign links

# against the freebl that we just built. This is necessary

# because the signing algorithm changed on 3.14 to DSA2 with SHA256

# whereas we previously signed with DSA and SHA1. We must Keep this line

# until all mock platforms have been updated.

# After %%{__os_install_post} we would add

#export LD_LIBRARY_PATH=$RPM_BUILD_ROOT/%{_libdir}

%define __spec_install_post \

    %{?__debug_package:%{__debug_install_post}} \

    %{__arch_install_post} \

    %{__os_install_post} \

    $RPM_BUILD_ROOT/%{unsupported_tools_directory}/shlibsign -i $RPM_BUILD_ROOT/%{_libdir}/libsoftokn3.so \

    $RPM_BUILD_ROOT/%{unsupported_tools_directory}/shlibsign -i $RPM_BUILD_ROOT/%{_libdir}/libfreeblpriv3.so \

    $RPM_BUILD_ROOT/%{unsupported_tools_directory}/shlibsign -i $RPM_BUILD_ROOT/%{_libdir}/libfreebl3.so \

    $RPM_BUILD_ROOT/%{unsupported_tools_directory}/shlibsign -i $RPM_BUILD_ROOT/%{_libdir}/libnssdbm3.so \

%{nil}

Summary:          Network Security Services Softoken Module

Name:             nss-softokn

Version:          3.16.2.3

Release:          14.4%{?dist}

License:          MPLv2.0

URL:              http://www.mozilla.org/projects/security/pki/nss/

Group:            System Environment/Libraries

Requires:         nspr >= %{nspr_version}

Requires:         nss-util >= %{nss_util_version}%{nss_util_build}

Requires:         nss-softokn-freebl%{_isa} >= %{version}-%{release}

BuildRoot:        %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)

BuildRequires:    nspr-devel >= %{nspr_version}

BuildRequires:    nss-util-devel >= %{nss_util_version}%{nss_util_build}

BuildRequires:    sqlite-devel

BuildRequires:    zlib-devel

BuildRequires:    pkgconfig

BuildRequires:    gawk

BuildRequires:    psmisc

BuildRequires:    perl

Source0:          %{name}-%{version}.tar.gz

# The nss-softokn tar ball is a subset of nss-{version}.tar.gz.

# We use the nss-split-softokn.sh script to keep only what we need

# via via nss-split-softokn.sh ${version}

# Detailed Steps:

# rhpkg clone nss-softokn

# cd nss-softokn

# Split off nss-softokn out of the full nss source tar ball:

# sh ./nss-split-softokn.sh ${version}

# A file named {name}-{version}.tar.gz should appear

# which is ready for uploading to the lookaside cache.

Source1:          nss-split-softokn.sh

Source2:          nss-softokn.pc.in

Source3:          nss-softokn-config.in

Source4:	  nss-softokn-prelink.conf

Source5:	  nss-softokn-dracut-module-setup.sh

Source6:	  nss-softokn-dracut.conf

Patch1:           build-nss-softoken-only.patch

# Build only the softoken and freebl related tools

Patch8:           softoken-minimal-test-dependencies.patch

# Select the tests to run based on the type of build

# This patch uses the gcc-iquote dir option documented at

# http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options

# to place the in-tree directories at the head of the list on list of directories

# to be searched for for header files. This ensures a build even when system freebl 

# headers are older. Such is the case when we are starting a major update.

# NSSUTIL_INCLUDE_DIR, after all, contains both util and freebl headers. 

# Once has been bootstapped the patch may be removed, but it doesn't hurt to keep it.

Patch10:           iquote.patch

Patch11:           nss-softokn-allow-level1.patch

Patch12:           additional-covscan-fixes.patch

Patch13:           nss-softokn-3.16-tls12-mechanisms.patch

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=923089

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=951455

Patch14:	   nss-softokn-3.16-sha384-key-derive.patch

# Patch related to CVE-2015-2730

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1125025

# from https://hg.mozilla.org/projects/nss/rev/2c05e861ce07

Patch102:           CheckForPeqQ-or-PnoteqQ-before-adding-P-and-Q.patch

# FIPS update

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1181814

Patch80:	nss-softokn-3.16-fips-post.patch

Patch81:	nss-softokn-3.16-fips.patch

Patch82:	nss-softokn-3.16-fips-rem-old-test.patch

Patch83:	nss-softokn-3.16-lowhash-test.patch

Patch90:	nss-softokn-3.16-addG.patch

Patch94:	nss-softokn-3.16-rsa-fips-186.patch

Patch95:	nss-softokn-3.16-ppc-no-init_support.patch

Patch97:	nss-softokn-3.16-add_encrypt_derive.patch

Patch98:	nss-softokn-3.16.allow_level1_init.patch

Patch99:	nss-softokn-3.16-fips_user_slots.patch

Patch100:	nss-softokn-3.16-block-sigchld.patch

Patch200:	nss-softokn-3.16-fipstest.patch

Patch201:	nss-softokn-3.16-fipstest-186-4.patch

Patch202:	nss-softokn-fix-error-handling.patch

Patch203:	nss-softokn-3.16-freebl_dyload.patch

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1113632

Patch204:	limit-create-fipscheck.patch

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=923089

# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=951455

Patch205:	nss-softokn-3.16-tls12-mechanisms-fipstest.patch

# https://bugzilla.redhat.com/show_bug.cgi?id=1053437

Patch206:   skip-check-fork-in_GetFunctionList.patch

%description

Network Security Services Softoken Cryptographic Module

%package freebl

Summary:          Freebl library for the Network Security Services

Group:            System Environment/Base

Conflicts:        nss < 3.12.2.99.3-5

Conflicts:        prelink < 0.4.3

Conflicts:        filesystem < 3

%description freebl

NSS Softoken Cryptographic Module Freebl Library

Install the nss-softokn-freebl package if you need the freebl 

library.

%package freebl-devel

Summary:          Header and Library files for doing development with the Freebl library for NSS

Group:            System Environment/Base

Provides:         nss-softokn-freebl-static = %{version}-%{release}

Requires:         nss-softokn-freebl%{?_isa} = %{version}-%{release}

%description freebl-devel

NSS Softoken Cryptographic Module Freebl Library Development Tools

This package supports special needs of some PKCS #11 module developers and

is otherwise considered private to NSS. As such, the programming interfaces

may change and the usual NSS binary compatibility commitments do not apply.

Developers should rely only on the officially supported NSS public API.

%package devel

Summary:          Development libraries for Network Security Services

Group:            Development/Libraries

Requires:         nss-softokn%{?_isa} = %{version}-%{release}

Requires:         nss-softokn-freebl-devel%{?_isa} = %{version}-%{release}

Requires:         nspr-devel >= %{nspr_version}

Requires:         nss-util-devel >= %{nss_util_version}%{nss_util_build}

Requires:         pkgconfig

BuildRequires:    nspr-devel >= %{nspr_version}

BuildRequires:    nss-util-devel >= %{nss_util_version}%{nss_util_build}

# require nss at least the version when we split via subpackages

%description devel

Header and library files for doing development with Network Security Services.

%prep

%setup -q

%patch1 -p0 -b .softokenonly

%patch8 -p0 -b .crypto

# activate if needed when doing a major update with new apis

#%patch10 -p0 -b .iquote

%patch11 -p0 -b .allow_level1

#fips

%patch80 -p0 -b .fips-post

%patch81 -p0 -b .fips

%patch82 -p0 -b .rm-old-test

%patch83 -p0 -b .lowhash-test

%patch90 -p0 -b .addG

%patch94 -p1 -b .fips-186-4

%patch95 -p0 -b .ppc_no_init_support

%patch97 -p0 -b .add_encrypt_derive

%patch98 -p0 -b .allow_level1_init

%patch99 -p0 -b .fips_user_slots

%patch100 -p0 -b .block_sigchld

%patch200 -p0 -b .fipstest

%patch201 -p0 -b .fipstest-186-4

%patch202 -p0 -b .1154764

%patch203 -p0 -b .freebl-dyload

%patch204 -p0 -b .limit_create_fips_check

%patch205 -p0 -b .1212106

# https://bugzilla.redhat.com/show_bug.cgi?id=1053437

%patch206 -p3 -b .skipcheckfork

%patch12 -p0 -b .1154764extras

pushd nss

%patch13 -p1 -b .1212106

popd

%patch14 -p1 -b .sha384_key_derive

pushd nss

%patch102 -p1 -b .extra_check

popd

%build

# partial RELRO support as a security enhancement

LDFLAGS+=-Wl,-z,relro

export LDFLAGS

FREEBL_NO_DEPEND=1

export FREEBL_NO_DEPEND

# Must export FREEBL_LOWHASH=1 for nsslowhash.h so that it gets

# copied to dist and the rpm install phase can find it

# This due of the upstream changes to fix

# https://bugzilla.mozilla.org/show_bug.cgi?id=717906

FREEBL_LOWHASH=1

export FREEBL_LOWHASH

#FREEBL_USE_PRELINK=1

#export FREEBL_USE_PRELINK

# Enable compiler optimizations and disable debugging code

BUILD_OPT=1

export BUILD_OPT

# Uncomment to disable optimizations

#RPM_OPT_FLAGS=`echo $RPM_OPT_FLAGS | sed -e 's/-O2/-O0/g'`

#export RPM_OPT_FLAGS

# Generate symbolic info for debuggers

XCFLAGS=$RPM_OPT_FLAGS

export XCFLAGS

PKG_CONFIG_ALLOW_SYSTEM_LIBS=1

PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1

export PKG_CONFIG_ALLOW_SYSTEM_LIBS

export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS

NSPR_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nspr | sed 's/-I//'`

NSPR_LIB_DIR=`/usr/bin/pkg-config --libs-only-L nspr | sed 's/-L//'`

export NSPR_INCLUDE_DIR

export NSPR_LIB_DIR

export NSSUTIL_INCLUDE_DIR=`/usr/bin/pkg-config --cflags-only-I nss-util | sed 's/-I//'`

export NSSUTIL_LIB_DIR=%{_libdir}

NSS_USE_SYSTEM_SQLITE=1

export NSS_USE_SYSTEM_SQLITE

%ifnarch noarch

%if 0%{__isa_bits} == 64

USE_64=1

export USE_64

%endif

%endif

# uncomment if the iquote patch is activated

export IN_TREE_FREEBL_HEADERS_FIRST=1

# Use only the basicutil subset for sectools.a

export NSS_BUILD_SOFTOKEN_ONLY=1

# display processor information

CPU_INFO=`cat /proc/cpuinfo`

echo "############## CPU INFO ##################"

echo "${CPU_INFO}"

echo "##########################################"

# Compile softokn plus needed support

%{__make} -C ./nss/coreconf

%{__make} -C ./nss/lib/dbm

%{__make} -C ./nss

# Set up our package file

# The nspr_version and nss_util_version globals used here

# must match the ones nss-softokn has for its Requires. 

%{__mkdir_p} ./dist/pkgconfig

%{__cat} %{SOURCE2} | sed -e "s,%%libdir%%,%{_libdir},g" \

                          -e "s,%%prefix%%,%{_prefix},g" \

                          -e "s,%%exec_prefix%%,%{_prefix},g" \

                          -e "s,%%includedir%%,%{_includedir}/nss3,g" \

                          -e "s,%%NSPR_VERSION%%,%{nspr_version},g" \

                          -e "s,%%NSSUTIL_VERSION%%,%{nss_util_version},g" \

                          -e "s,%%SOFTOKEN_VERSION%%,%{version},g" > \

                          ./dist/pkgconfig/nss-softokn.pc

SOFTOKEN_VMAJOR=`cat nss/lib/softoken/softkver.h | grep "#define.*SOFTOKEN_VMAJOR" | awk '{print $3}'`

SOFTOKEN_VMINOR=`cat nss/lib/softoken/softkver.h | grep "#define.*SOFTOKEN_VMINOR" | awk '{print $3}'`

SOFTOKEN_VPATCH=`cat nss/lib/softoken/softkver.h | grep "#define.*SOFTOKEN_VPATCH" | awk '{print $3}'`

export SOFTOKEN_VMAJOR

export SOFTOKEN_VMINOR

export SOFTOKEN_VPATCH

%{__cat} %{SOURCE3} | sed -e "s,@libdir@,%{_libdir},g" \

                          -e "s,@prefix@,%{_prefix},g" \

                          -e "s,@exec_prefix@,%{_prefix},g" \

                          -e "s,@includedir@,%{_includedir}/nss3,g" \

                          -e "s,@MOD_MAJOR_VERSION@,$SOFTOKEN_VMAJOR,g" \

                          -e "s,@MOD_MINOR_VERSION@,$SOFTOKEN_VMINOR,g" \

                          -e "s,@MOD_PATCH_VERSION@,$SOFTOKEN_VPATCH,g" \

                          > ./dist/pkgconfig/nss-softokn-config

chmod 755 ./dist/pkgconfig/nss-softokn-config

%check

if [ ${DISABLETEST:-0} -eq 1 ]; then

  echo "testing disabled"

  exit 0

fi

# Begin -- copied from the build section

FREEBL_NO_DEPEND=1

export FREEBL_NO_DEPEND

BUILD_OPT=1

export BUILD_OPT

%ifnarch noarch

%if 0%{__isa_bits} == 64

USE_64=1

export USE_64

%endif

%endif

# to test for the last tool built correctly

export NSS_BUILD_SOFTOKEN_ONLY=1

# End -- copied from the build section

# enable the following line to force a test failure

# find . -name \*.chk | xargs rm -f

# Run test suite.

SPACEISBAD=`find ./nss/tests | grep -c ' '` ||:

if [ $SPACEISBAD -ne 0 ]; then

  echo "error: filenames containing space are not supported (xargs)"

  exit 1

fi

rm -rf ./tests_results

pushd ./nss/tests/

# all.sh is the test suite script

# only run cipher tests for nss-softokn

%global nss_cycles "standard"

%global nss_tests "cipher lowhash"

%global nss_ssl_tests " "

%global nss_ssl_run " "

HOST=localhost DOMSUF=localdomain PORT=$MYRAND NSS_CYCLES=%{?nss_cycles} NSS_TESTS=%{?nss_tests} NSS_SSL_TESTS=%{?nss_ssl_tests} NSS_SSL_RUN=%{?nss_ssl_run} ./all.sh

popd

# Normally, the grep exit status is 0 if selected lines are found and 1 otherwise,

# Grep exits with status greater than 1 if an error ocurred. 

# If there are test failures we expect TEST_FAILURES > 0 and GREP_EXIT_STATUS = 0, 

# With no test failures we expect TEST_FAILURES = 0 and GREP_EXIT_STATUS = 1, whereas 

# GREP_EXIT_STATUS > 1 would indicate an error in grep such as failure to find the log file.

killall $RANDSERV || :

TEST_FAILURES=$(grep -c FAILED ./tests_results/security/localhost.1/output.log) || GREP_EXIT_STATUS=$?

if [ ${GREP_EXIT_STATUS:-0} -eq 1 ]; then

  echo "okay: test suite detected no failures"

else

  %ifarch %{arm}

    :

    # do nothing on arm where the test suite is failing and has been

    # for while, do run the test suite but make it non fatal on arm

  %else

  if [ ${GREP_EXIT_STATUS:-0} -eq 0 ]; then

    # while a situation in which grep return status is 0 and it doesn't output

    # anything shouldn't happen, set the default to something that is

    # obviously wrong (-1)

    echo "error: test suite had ${TEST_FAILURES:--1} test failure(s)"

    exit 1

  else

    if [ ${GREP_EXIT_STATUS:-0} -eq 2 ]; then

      echo "error: grep has not found log file"

      exit 1

    else

      echo "error: grep failed with exit code: ${GREP_EXIT_STATUS}"

      exit 1

    fi

  fi

%endif

fi

echo "test suite completed"

%install

%{__rm} -rf $RPM_BUILD_ROOT

# There is no make install target so we'll do it ourselves.

%{__mkdir_p} $RPM_BUILD_ROOT/%{_includedir}/nss3

%{__mkdir_p} $RPM_BUILD_ROOT/%{_bindir}

%{__mkdir_p} $RPM_BUILD_ROOT/%{_libdir}

%{__mkdir_p} $RPM_BUILD_ROOT/%{unsupported_tools_directory}

%{__mkdir_p} $RPM_BUILD_ROOT/%{_libdir}/pkgconfig

%{__mkdir_p} $RPM_BUILD_ROOT/%{saved_files_dir}

%{__mkdir_p} $RPM_BUILD_ROOT/%{prelink_conf_dir}

%{__mkdir_p} $RPM_BUILD_ROOT/%{dracut_modules_dir}

%{__mkdir_p} $RPM_BUILD_ROOT/%{dracut_conf_dir}

%{__install} -m 644 %{SOURCE4} $RPM_BUILD_ROOT/%{prelink_conf_dir}

%{__install} -m 755 %{SOURCE5} $RPM_BUILD_ROOT/%{dracut_modules_dir}/module-setup.sh

%{__install} -m 644 %{SOURCE6} $RPM_BUILD_ROOT/%{dracut_conf_dir}/50-nss-softokn.conf

# Copy the binary libraries we want

for file in libsoftokn3.so libnssdbm3.so libfreebl3.so libfreeblpriv3.so

do

  %{__install} -p -m 755 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}

done

# Copy the binaries we ship as unsupported

for file in bltest fipstest shlibsign

do

  %{__install} -p -m 755 dist/*.OBJ/bin/$file $RPM_BUILD_ROOT/%{unsupported_tools_directory}

done

# Copy the include files we want

for file in dist/public/nss/*.h

do

  %{__install} -p -m 644 $file $RPM_BUILD_ROOT/%{_includedir}/nss3

done

# Copy some freebl include files we also want

for file in blapi.h alghmac.h

do

  %{__install} -p -m 644 dist/private/nss/$file $RPM_BUILD_ROOT/%{_includedir}/nss3

done

# Copy the static freebl library

for file in libfreebl.a

do

%{__install} -p -m 644 dist/*.OBJ/lib/$file $RPM_BUILD_ROOT/%{_libdir}

done

# Copy the package configuration files

%{__install} -p -m 644 ./dist/pkgconfig/nss-softokn.pc $RPM_BUILD_ROOT/%{_libdir}/pkgconfig/nss-softokn.pc

%{__install} -p -m 755 ./dist/pkgconfig/nss-softokn-config $RPM_BUILD_ROOT/%{_bindir}/nss-softokn-config

%clean

%{__rm} -rf $RPM_BUILD_ROOT

%post -p /sbin/ldconfig

%postun -p /sbin/ldconfig

%files

%defattr(-,root,root)

%{_libdir}/libnssdbm3.so

%{_libdir}/libnssdbm3.chk

%{_libdir}/libsoftokn3.so

%{_libdir}/libsoftokn3.chk

# shared with nss-tools

%dir %{_libdir}/nss

%dir %{saved_files_dir}

%dir %{unsupported_tools_directory}

%{unsupported_tools_directory}/bltest

%{unsupported_tools_directory}/fipstest

%{unsupported_tools_directory}/shlibsign

#shared

%files freebl

%defattr(-,root,root)

%{_libdir}/libfreebl3.so

%{_libdir}/libfreebl3.chk

%{_libdir}/libfreeblpriv3.so

%{_libdir}/libfreeblpriv3.chk

#shared

%dir %{prelink_conf_dir}

%{prelink_conf_dir}/nss-softokn-prelink.conf

%dir %{dracut_modules_dir}

%{dracut_modules_dir}/module-setup.sh

%{dracut_conf_dir}/50-nss-softokn.conf

%files freebl-devel

%defattr(-,root,root)

%{_libdir}/libfreebl.a

%{_includedir}/nss3/blapi.h

%{_includedir}/nss3/blapit.h

%{_includedir}/nss3/alghmac.h

%files devel

%defattr(-,root,root)

%{_libdir}/pkgconfig/nss-softokn.pc

%{_bindir}/nss-softokn-config

# co-owned with nss

%dir %{_includedir}/nss3

#

# The following headers are those exported public in

# nss/lib/freebl/manifest.mn and

# nss/lib/softoken/manifest.mn

#

# The following list is short because many headers, such as

# the pkcs #11 ones, have been provided by nss-util-devel

# which installed them before us.

#

%{_includedir}/nss3/ecl-exp.h

%{_includedir}/nss3/nsslowhash.h

%{_includedir}/nss3/shsign.h

%changelog

* Tue Jun 28 2016 Kai Engert <kaie@redhat.com> - 3.16.2.3-14.4

- escape all percent characters in all changelog comments

* Wed Apr 20 2016 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-14.3

- Fix a flaw in %%check for nss not building on arm

- Resolves: Bug 1200856

* Fri Apr 15 2016 Kai Engert <kaie@redhat.com> - 3.16.2.3-14.2

- Adjust for a renamed variable in newer nss-util, require a compatible nss-util version.

* Mon Apr 11 2016 Kai Engert <kaie@redhat.com> - 3.16.2.3-14.1

- Pick up a bugfix related to fork(), to avoid a regression with NSS 3.21

* Fri Aug 07 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-14

- Pick up upstream freebl patch for CVE-2015-2730

- Check for P == Q or P ==-Q before adding P and Q

* Thu Jul 16 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-13

- Add links to filed upstream bugs to better track patches in spec file

* Wed Jun 24 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-12

- Bump nss_util_version to 3.19.1

* Fri May 29 2015 Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-11

- Make sure we have enough space for generating keyblocks for ciphers with HMAC_SHA384 (TLS).

* Wed Apr 29 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-10

- Use the TLS 1.2 mechanisms for PKCS #11 added for V2.40

* Mon Feb 02 2015 Tomáš Mráz <tmraz@redhat.com> - 3.16.2.3-9

- add configuration file for dracut to add the nss-softokn module by default

* Thu Jan 29 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-8

- fix permissions on dracut install file.

- Resolves: Bug 1169957 - curl unable to download url when url is https and environment is dracut

* Tue Jan 20 2015 Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-7

- Use RHEL-7 dracut semantics rather than RHEL-6

- fix dependencies so nss-softokn pulls in nss-softokn-freebl

- keep dummy libfreebl3.chk for dracut kernel.

* Tue Jan 13 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-6

- Update fix for flaws reported by coverity scan  

- Resolves: Bug 1154764 - Defects found in nss-softokn

* Fri Jan 09 2015 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-5

- Skip the fips checks if the action is newslot or delslot.

- Resolves: Bug 1156406 - NSS fails to access sql:/etc/pki/nssdb in system FIPS mode

* Wed Dec 10 2014 Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-4

- add libfreeblpriv3.so to dracut.

* Tue Nov 18 2014 Robert Relyea <rrelyea@redhat.com> - 3.16.2.3-3

- Resolves: Bug 1153602 - libfreebl3.so runs prelink during the initialization phase

- Decouple libfreebl3.so from the actual library.

- Blacklist the freebl libraries

- Turn off calling prelink to unprelink the binary

* Tue Nov 18 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2

- Remove temporary workaround for brew build problems now resolved

- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3

* Thu Nov 13 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-13

- Resolves: Bug 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3

* Wed Nov 05 2014 Robert Relyea <rrelyea@redhat.com> 3.16.2-12

- Add support for encrypt_derive.

- Allow us to init database at level1 while already in FIPS mode.

- Allow UserDBOpen'ed FIPS tokens to do all the mechanisms as well as

  the main fips token.

- Silence SIGCHLD when prelink is used.

* Tue Oct 21 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-11

- Fix the location of an upstream URL reference

* Tue Oct 21 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-10

- Resolves: Bug 1154232 - nss tools core dump on ppc64

* Tue Oct 21 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-9

- Resolves: Bug 1154764 - Defects found in nss-softokn-3.16.2-7.el7

* Thu Oct 16 2014 Robert Relyea <rrelyea@redhat.com> 3.16.2-8

- Conform RSA keygen to FIPS 186-4 tests

* Fri Oct 10 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-7

- Change RSA_PrivateKeyCheck to not require p > q

- Resolves: Bug 1150645 - Importing an RSA private key fails if p < q

* Sat Sep 27 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-6

- Add lowhash to the softoken tests to run as done on rhel-6.6

- Adapt suboptimal shell code in nss.spec fix from bug 108750

- Resolves: Bug 1145434 - CVE-2014-1568

* Sat Sep 27 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-5- 

- Fix incorrect path in the %%check section

- Add way to skip test suite execution during development work

- Resolves: Bug 1145434 - CVE-2014-1568

* Thu Sep 25 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-4

- Resolves: Bug 1145434 - CVE-2014-1568

* Mon Sep 22 2014 Robert Relyea <rrelyea@redhat.com> 3.16.2-3

- Update for FIPS validation

* Tue Aug 05 2014 Elio Maldonado <emaldona@redhat.com> 3.16.2-2

- Generic 32/64 bit platform detection (fix ppc64le build)

- Resolves: Bug 1125620 - nss-softokn fails to build on arch: ppc64le (build failure)

- Fix contributed by Peter Robinson <pbrobinson@redhat.com>

* Tue Jul 08 2014 Elio Maldonado <emaldona@redhat.com> - 3.16.2-1

- Update to nss-3.16.2

- Resolves: Bug 1103925 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)

* Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 3.15.4-2

- Mass rebuild 2014-01-24

* Sun Jan 19 2014 Elio Maldonado <emaldona@redhat.com> - 3.15.3-4

- Rebase to nss-3.15.4

- Resolves: Bug 1054457 - CVE-2013-1740

- Update softokn splitting script to oparate on the upstream pristine source

- Using the .gz archives directly, not repackaging as .bz2 ones

- Avoid unneeded manual steps that could introduce errors

- Update the iquote and build softoken only patches on account of the rebase

* Sun Jan 19 2014 Elio Maldonado <emaldona@redhat.com> - 3.15.3-3

- Fix to allow level 1 fips mode if the db has no password

- Resolves: Bug 852023 - FIPS mode detection does not work

* Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 3.15.3-2

- Mass rebuild 2013-12-27

* Mon Nov 25 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.3-1

- Rebase to NSS_3_15_3_RTM

- Related: Bug 1031463 - CVE-2013-5605 CVE-2013-5606 CVE-2013-1741

* Tue Oct 29 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.2-2

- Resolves: rhbz#1020395 - Allow Level 1 FIPS mode if the nss db has no password

* Mon Oct 21 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.2-1

- Rebase to nss-softoken from nss-3.15.2

- Resolves: rhbz#1012679 - pick up NSS-SOFTOKN 3.15.2 (required for bug 1012656)

* Thu Oct 10 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.1-3

- Add export NSS_ENABLE_ECC=1 rto the %%build and %%check sections

- Resolves: rhbz#752980 - [7.0 FEAT] Support ECDSA algorithm in the nss packag

* Tue Aug 06 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.1-2

- Remove an obsolete script and adjust the sources numbering accordingly

* Fri Jul 26 2013 Elio Maldonado <emaldona@redhat.com> - 3.15.1-1

- Update to NSS_3_15_1_RTM

* Tue Jul 02 2013 Elio Maldonado <emaldona@redhat.com> - 3.15-4

- Split off nss-softokn from the unstripped nss source tar ball

* Mon Jun 17 2013 Elio Maldonado <emaldona@redhat.com> - 3.15-3

- Update to NSS_3_15_RTM

- Require nspr-4.10 or greater

- Fix patch that selects tests to run

* Tue Apr 23 2013 Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.3

- Reverse the last changes since pk11gcmtest properly belongs to nss

* Tue Apr 23 2013 Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.2

- Add lowhashtest and pk11gcmtest as unsupported tools

- Modify nss-softoken-split script to include them in the split

* Fri Apr 05 2013 Elio Maldonado <emaldona@redhat.com> - 3.15-0.1.beta.1

- Update to NSS_3_15_BETA1

- Update spec file, patches, and helper scrips on account of a shallwer source tree

* Fri Feb 15 2013 Elio Maldonado <emaldona@redhat.com> - 3.14.3-1

- Update to NSS_3_14_3_RTM

- Resolves: rhbz#909781 - specfile support for AArch64

* Mon Feb 04 2013 Elio Maldonado <emaldona@redhat.com> - 3.14.2-3

- Allow building nss-softokn against older system sqlite

* Sat Feb 02 2013 Elio Maldonado <emaldona@redhat.com> - 3.14.2-2

- Update to NSS_3_14_2_RTM

- Restore comments on how to transition when signing algorithm changes

- Remove unused patches

* Fri Feb 01 2013 Elio Maldonado <emaldona@redhat.com> - 3.14.2-1

- Update to NSS_3_14_2_RTM

* Thu Dec 27 2012 Elio Maldonado <emaldona@redhat.com> - 3.14.1-5

- Add RSA performance test for freebl

- Fix bogus date in changelog warnings

* Mon Dec 24 2012 Elio Maldonado <emaldona@redhat.com> - 3.14.1-4

- Fix bogus date warnings in %%changelog

* Sat Dec 22 2012 Elio Maldonado <emaldona@redhat.com> - 3.14.1-3

- Cleanup patches for building softoken only libraries and tests

* Mon Dec 17 2012 Elio Maldonado <emaldona@redhat.com> - 3.14.1-2

- Require nspr version >= 4.9.4

* Mon Dec 17 2012 Elio Maldonado <emaldona@redhat.com> - 3.14.1-1

- Update to NSS_3_14_1_RTM

* Mon Dec 03 2012 Elio Maldonado <emaldona@redhat.com> - 3.14-6

- Bug 883114 - Install bltest and fipstest as unsupported tools

* Mon Nov 19 2012 Elio Maldonado <emaldona@redhat.com> - 3.14-5