diff --git a/.gitignore b/.gitignore
index 47ef717..195749f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/nss-util-3.21.3.tar.gz
+SOURCES/nss-util-3.28.2.tar.gz
diff --git a/.nss-util.metadata b/.nss-util.metadata
index 75e24d8..d7a7797 100644
--- a/.nss-util.metadata
+++ b/.nss-util.metadata
@@ -1 +1 @@
-5fbd7801bca0ececb9867770af7beb2b6cf43a91 SOURCES/nss-util-3.21.3.tar.gz
+355533d25b246ae91a54d2253757d9a17506143d SOURCES/nss-util-3.28.2.tar.gz
diff --git a/SOURCES/build-nss-util-only.patch b/SOURCES/build-nss-util-only.patch
deleted file mode 100644
index ba62231..0000000
--- a/SOURCES/build-nss-util-only.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-diff -up nss/cmd/manifest.mn.utilonly nss/cmd/manifest.mn
---- nss/cmd/manifest.mn.utilonly 2013-05-29 15:34:19.634715650 -0700
-+++ nss/cmd/manifest.mn 2013-05-29 15:35:25.460227028 -0700
-@@ -8,55 +8,7 @@ DEPTH = ..
-
- REQUIRES = nss nspr libdbm
-
--DIRS = lib \
-- addbuiltin \
-- atob \
-- $(BLTEST_SRCDIR) \
-- btoa \
-- certcgi \
-- certutil \
-- checkcert \
-- chktest \
-- crlutil \
-- crmftest \
-- dbtest \
-- derdump \
-- digest \
-- httpserv \
-- $(FIPSTEST_SRCDIR) \
-- $(LOWHASHTEST_SRCDIR) \
-- listsuites \
-- makepqg \
-- multinit \
-- ocspclnt \
-- ocspresp \
-- oidcalc \
-- p7content \
-- p7env \
-- p7sign \
-- p7verify \
-- pk12util \
-- pk11gcmtest \
-- pk11mode \
-- pk1sign \
-- pkix-errcodes \
-- pp \
-- pwdecrypt \
-- rsaperf \
-- sdrtest \
-- selfserv \
-- signtool \
-- signver \
-- $(SHLIBSIGN_SRCDIR) \
-- smimetools \
-- ssltap \
-- strsclnt \
-- symkeyutil \
-- tests \
-- tstclnt \
-- vfychain \
-- vfyserv \
-- modutil \
-+DIRS = \
- $(NULL)
-
- TEMPORARILY_DONT_BUILD = \
-diff -up nss/lib/Makefile.utilonly nss/lib/Makefile
---- nss/lib/Makefile.utilonly 2013-05-29 15:36:49.223876575 -0700
-+++ nss/lib/Makefile 2013-05-29 15:39:52.052290168 -0700
-@@ -46,6 +46,10 @@ ifndef NSS_DISABLE_DBM
- DBM_SRCDIR = dbm # Add the dbm directory to DIRS.
- endif
-
-+ifeq ($(NSS_BUILD_UTIL_ONLY),1)
-+SYSINIT_SRCDIR=
-+endif
-+
- #######################################################################
- # (5) Execute "global" rules. (OPTIONAL) #
- #######################################################################
-diff -up nss/lib/manifest.mn.utilonly nss/lib/manifest.mn
---- nss/lib/manifest.mn.utilonly 2013-05-29 15:40:21.073514078 -0700
-+++ nss/lib/manifest.mn 2013-05-29 15:41:24.308001547 -0700
-@@ -18,17 +18,6 @@ DEPTH = ..
- # crmf jar (not dll's)
- DIRS = \
- $(UTIL_SRCDIR) \
-- $(FREEBL_SRCDIR) \
-- $(SQLITE_SRCDIR) \
-- $(DBM_SRCDIR) \
-- $(SOFTOKEN_SRCDIR) \
-- base dev pki \
-- libpkix \
-- certdb certhigh pk11wrap cryptohi nss \
-- $(ZLIB_SRCDIR) ssl \
-- pkcs7 pkcs12 smime \
-- crmf jar \
-- ckfw $(SYSINIT_SRCDIR) \
- $(NULL)
-
- # fortcrypt is no longer built
diff --git a/SOURCES/nss-util-3.19.1-tls12-mechanisms.patch b/SOURCES/nss-util-3.19.1-tls12-mechanisms.patch
index 77125f2..b631dbe 100644
--- a/SOURCES/nss-util-3.19.1-tls12-mechanisms.patch
+++ b/SOURCES/nss-util-3.19.1-tls12-mechanisms.patch
@@ -1,7 +1,7 @@
diff -up ./nss/lib/util/pkcs11t.h.tls12_mechs ./nss/lib/util/pkcs11t.h
---- ./nss/lib/util/pkcs11t.h.tls12_mechs 2015-11-08 21:12:59.000000000 -0800
-+++ ./nss/lib/util/pkcs11t.h 2016-02-02 07:27:51.243330963 -0800
-@@ -1695,6 +1695,10 @@ typedef struct CK_TLS_MAC_PARAMS {
+--- ./nss/lib/util/pkcs11t.h.tls12_mechs 2017-01-13 16:33:12.199107708 +0100
++++ ./nss/lib/util/pkcs11t.h 2017-01-13 16:34:12.479625017 +0100
+@@ -1650,6 +1650,10 @@ typedef struct CK_TLS_MAC_PARAMS {
typedef CK_TLS_MAC_PARAMS CK_PTR CK_TLS_MAC_PARAMS_PTR;
@@ -11,4 +11,4 @@ diff -up ./nss/lib/util/pkcs11t.h.tls12_mechs ./nss/lib/util/pkcs11t.h
+
/* WTLS is new for version 2.20 */
typedef struct CK_WTLS_RANDOM_DATA {
- CK_BYTE_PTR pClientRandom;
+ CK_BYTE_PTR pClientRandom;
diff --git a/SOURCES/nss-util-ecpoint-encoding.patch b/SOURCES/nss-util-ecpoint-encoding.patch
new file mode 100644
index 0000000..494e182
--- /dev/null
+++ b/SOURCES/nss-util-ecpoint-encoding.patch
@@ -0,0 +1,30 @@
+
+# HG changeset patch
+# User Kai Engert <kaie@kuix.de>
+# Date 1487329827 -3600
+# Node ID 0050234a859c2aac2cf8cb5092218191300b1901
+# Parent 0e25df041c8fdc8610c6f227084d11eb8ad81149
+Bug 1340103, Introduction of SECKEYECPublicKey.encoding in NSS 3.28 broke ABI, r=rrelyea/mt
+
+diff --git a/lib/util/eccutil.h b/lib/util/eccutil.h
+--- a/lib/util/eccutil.h
++++ b/lib/util/eccutil.h
+@@ -1,14 +1,15 @@
+ /* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+ #ifndef _FREEBL_H_
+ #define _FREEBL_H_
+
+-/* point encoding type */
++/* deprecated */
+ typedef enum {
+ ECPoint_Uncompressed,
+- ECPoint_XOnly
++ ECPoint_XOnly,
++ ECPoint_Undefined
+ } ECPointEncoding;
+
+ #endif /* _FREEBL_H_ */
+
diff --git a/SPECS/nss-util.spec b/SPECS/nss-util.spec
index eaddc20..43e5c96 100644
--- a/SPECS/nss-util.spec
+++ b/SPECS/nss-util.spec
@@ -1,10 +1,10 @@
-%global nspr_version 4.11.0
+%global nspr_version 4.13.1
# adjust to the very latest build needed
-%global nspr_build_version -1
+%global nspr_build_version -1.0
Summary: Network Security Services Utilities Library
Name: nss-util
-Version: 3.21.3
+Version: 3.28.2
Release: 1.1%{?dist}
License: MPLv2.0
URL: http://www.mozilla.org/projects/security/pki/nss/
@@ -33,14 +33,14 @@ Source1: nss-split-util.sh
Source2: nss-util.pc.in
Source3: nss-util-config.in
-# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1186917
-Patch1: build-nss-util-only.patch
# Local patches
Patch2: hasht-dont-include-prtypes.patch
Patch7: pkcs1sig-include-prtypes.patch
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=951455
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=923089
Patch8: nss-util-3.19.1-tls12-mechanisms.patch
+# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1340103
+Patch9: nss-util-ecpoint-encoding.patch
%description
Utilities for Network Security Services and the Softoken module
@@ -61,10 +61,12 @@ Header and library files for doing development with Network Security Services.
%prep
%setup -q
-%patch1 -p0 -b .utilonly
%patch2 -p0 -b .prtypes
%patch7 -p0 -b .include_prtypes
%patch8 -p1 -b .tls12_mechs
+pushd nss
+%patch9 -p1 -b .ecpoint-encoding
+popd
%build
@@ -199,6 +201,7 @@ done
# these are marked as public export in nss/lib/util/manifest.mk
%{_includedir}/nss3/base64.h
%{_includedir}/nss3/ciferfam.h
+%{_includedir}/nss3/eccutil.h
%{_includedir}/nss3/hasht.h
%{_includedir}/nss3/nssb64.h
%{_includedir}/nss3/nssb64t.h
@@ -235,6 +238,14 @@ done
%{_includedir}/nss3/templates/templates.c
%changelog
+* Fri Feb 17 2017 Daiki Ueno <dueno@redhat.com> - 3.28.2-1.1
+- Prevent ABI incompatibility of SECKEYECPublicKey structure
+
+* Fri Feb 10 2017 Daiki Ueno <dueno@redhat.com> - 3.28.2-1.0
+- Rebase to nss-3.28.1
+- Remove upstreamed build-nss-util-only.patch
+- Package new header eccutil.h
+
* Wed Nov 02 2016 Kai Engert <kaie@redhat.com> - 3.21.3-1.1
- rebuild