chore: update to 3.92

Log:

debian/changelog

@@ -1,3 +1,17 @@
+nss (2:3.92-1) unstable; urgency=medium
+
+  * New upstream release. Closes: #1049979
+  * nss/lib/dbm/include/mcom_db.h: Undo previous changes for hppa, the issue
+    was fixed upstream.
+
+ -- Mike Hommey <[email protected]>  Fri, 18 Aug 2023 04:53:54 +0900
+
+nss (2:3.91-1) unstable; urgency=medium
+
+  * New upstream release.
+
+ -- Mike Hommey <[email protected]>  Wed, 05 Jul 2023 15:18:12 +0900
+
 nss (2:3.90-3) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Disable vale curve25519 code. It doesn't support

debian/patches/38_hurd.patch

@@ -7,15 +7,15 @@ Index: nss/nss/cmd/shlibsign/shlibsign.c
 ===================================================================
 --- nss.orig/nss/cmd/shlibsign/shlibsign.c
 +++ nss/nss/cmd/shlibsign/shlibsign.c
-@@ -725,7 +725,6 @@ main(int argc, char **argv)
+@@ -1260,7 +1260,6 @@ main(int argc, char **argv)
  #ifdef USES_LINKS
      int ret;
      struct stat stat_buf;
 -    char link_buf[MAXPATHLEN + 1];
      char *link_file = NULL;
  #endif
 
-@@ -1068,10 +1067,22 @@ main(int argc, char **argv)
+@@ -1511,10 +1510,22 @@ main(int argc, char **argv)
      }
      if (S_ISLNK(stat_buf.st_mode)) {
          char *dirpath, *dirend;
@@ -46,7 +46,7 @@ Index: nss/nss/lib/freebl/unix_rand.c
 ===================================================================
 --- nss.orig/nss/lib/freebl/unix_rand.c
 +++ nss/nss/lib/freebl/unix_rand.c
-@@ -843,6 +843,10 @@ RNG_FileForRNG(const char *fileName)
+@@ -756,6 +756,10 @@ RNG_FileForRNG(const char *fileName)
  #define _POSIX_PTHREAD_SEMANTICS
  #include <dirent.h>
 

debian/patches/series

@@ -1,4 +1,2 @@
 38_hurd.patch
 80_security_tools.patch
-38_hppa.patch
-99_vale_curve25519.patch

nss/.hg_archival.txt

@@ -1,4 +1,4 @@
 repo: 9949429068caa6bb8827a8ceeaa7c605d722f47f
-node: a7a037afb2bc43d92065fca9690d223794379e12
-branch: NSS_3_90_BRANCH
-tag: NSS_3_90_RTM
+node: 2c2c47e491d060cc5238bd084179bceda7968d39
+branch: default
+tag: NSS_3_92_RTM

nss/automation/abi-check/expected-report-libnssutil3.so.txt

@@ -1,5 +0,0 @@
-
-1 Added function:
-
-  'function void NSS_SecureSelect(void*, void*, void*, size_t, unsigned char)'    {NSS_SecureSelect@@NSSUTIL_3.90}
-

nss/automation/abi-check/previous-nss-release

@@ -1 +1 @@
-NSS_3_89_BRANCH
+NSS_3_91_BRANCH

nss/automation/taskcluster/graph/src/extend.js

@@ -636,7 +636,7 @@ async function scheduleLinux(name, overrides, args = "") {
       command: [
         "/bin/bash",
         "-c",
-        checkout_and_gyp + "--enable-legacy-db"
+        checkout_and_gyp + "--enable-legacy-db " + args
       ],
       symbol: "B",
       group: "DBM",

nss/automation/taskcluster/scripts/run_hacl.sh

@@ -12,7 +12,7 @@ set -e -x -v
 # Get the HACL* source, containing a snapshot of the C code, extracted on the
 # HACL CI.
 git clone -q "https://github.com/hacl-star/hacl-star" ~/hacl-star
-git -C ~/hacl-star checkout -q 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6
+git -C ~/hacl-star checkout -q 5f6051d2134cda490c890e57bb16da0110744646
 
 # Format the C snapshot.
 cd ~/hacl-star/dist/mozilla

nss/cmd/bltest/blapitest.c

@@ -642,6 +642,10 @@ typedef enum {
     bltestSHA256,       /* .             */
     bltestSHA384,       /* .             */
     bltestSHA512,       /* .             */
+    bltestSHA3_224,     /* .             */
+    bltestSHA3_256,     /* .             */
+    bltestSHA3_384,     /* .             */
+    bltestSHA3_512,     /* .             */
     NUMMODES
 } bltestCipherMode;
 
@@ -685,6 +689,10 @@ static char *mode_strings[] = {
     "sha256",
     "sha384",
     "sha512",
+    "sha3_224",
+    "sha3_256",
+    "sha3_384",
+    "sha3_512",
 };
 
 typedef struct
@@ -860,7 +868,7 @@ PRBool
 is_hashCipher(bltestCipherMode mode)
 {
     /* change as needed! */
-    if (mode >= bltestMD2 && mode <= bltestSHA512)
+    if (mode >= bltestMD2 && mode <= bltestSHA3_512)
         return PR_TRUE;
     return PR_FALSE;
 }
@@ -2436,6 +2444,34 @@ cipherInit(bltestCipherInfo *cipherInfo, PRBool encrypt)
                                                       : SHA512_HashBuf;
             return SECSuccess;
             break;
+        case bltestSHA3_224:
+            restart = cipherInfo->params.hash.restart;
+            SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
+                              SHA3_224_LENGTH);
+            cipherInfo->cipher.hashCipher = SHA3_224_HashBuf;
+            return SECSuccess;
+            break;
+        case bltestSHA3_256:
+            restart = cipherInfo->params.hash.restart;
+            SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
+                              SHA3_256_LENGTH);
+            cipherInfo->cipher.hashCipher = SHA3_256_HashBuf;
+            return SECSuccess;
+            break;
+        case bltestSHA3_384:
+            restart = cipherInfo->params.hash.restart;
+            SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
+                              SHA3_384_LENGTH);
+            cipherInfo->cipher.hashCipher = SHA3_384_HashBuf;
+            return SECSuccess;
+            break;
+        case bltestSHA3_512:
+            restart = cipherInfo->params.hash.restart;
+            SECITEM_AllocItem(cipherInfo->arena, &cipherInfo->output.buf,
+                              SHA3_512_LENGTH);
+            cipherInfo->cipher.hashCipher = SHA3_512_HashBuf;
+            return SECSuccess;
+            break;
         default:
             return SECFailure;
     }
@@ -2692,6 +2728,10 @@ cipherFinish(bltestCipherInfo *cipherInfo)
         case bltestSHA256:
         case bltestSHA384:
         case bltestSHA512:
+        case bltestSHA3_224:
+        case bltestSHA3_256:
+        case bltestSHA3_384:
+        case bltestSHA3_512:
             return SECSuccess;
             break;
         default:

nss/cmd/bltest/tests/sha3_224/ciphertext0

@@ -0,0 +1 @@
+5kKCTD+M8krQkjTufTx2b8mjpRaNDJStc7Rv3w==

nss/cmd/bltest/tests/sha3_224/ciphertext1

@@ -0,0 +1 @@
+zETk/sw7yR9vyKyHeowvdE7qZDvXRqjFNAODyw==

nss/cmd/bltest/tests/sha3_224/numtests

@@ -0,0 +1 @@
+2

nss/cmd/bltest/tests/sha3_224/plaintext0

@@ -0,0 +1 @@
+abc

nss/cmd/bltest/tests/sha3_224/plaintext1

@@ -0,0 +1 @@
+122EK2FIG0MB5BSL1SC5JGBW9RX44WHS

nss/cmd/bltest/tests/sha3_256/ciphertext0

@@ -0,0 +1 @@
+BBu9VoDtr36iEIcqkh5GSTVWgNbvfBKfXw7JQWMN1K4=

nss/cmd/bltest/tests/sha3_256/ciphertext1

@@ -0,0 +1 @@
+Wfasna8sxiTTAswiFp+hKz94w/IcrycenfQlx3tMcj0=

nss/cmd/bltest/tests/sha3_256/numtests

@@ -0,0 +1 @@
+2

nss/cmd/bltest/tests/sha3_256/plaintext0

@@ -0,0 +1 @@
+XG8XAO4I3YZNVJJ5K40R12F3YIRA7WP8

nss/cmd/bltest/tests/sha3_256/plaintext1

@@ -0,0 +1 @@
+DKOG28OVG5JCS7922VF7G00QBZTOA2Q2

nss/cmd/bltest/tests/sha3_384/ciphertext0

@@ -0,0 +1 @@
+lEDUd0ZL5Q+Q8v3YMw/mhulZ4IKML9XDmjLsffyRup43WaYCSYVIcpS6n7rezVZy

nss/cmd/bltest/tests/sha3_384/ciphertext1

@@ -0,0 +1 @@
+fzLOq3a6G7i5Yc/6KnDR/P8ZrnwHb+DlzhR+nIqCe6BhCGuyciUbetJ+C61Ygt74

nss/cmd/bltest/tests/sha3_384/numtests

@@ -0,0 +1 @@
+2

nss/cmd/bltest/tests/sha3_384/plaintext0

@@ -0,0 +1 @@
+TQWW3E325C08FJ1B8T4P6Q7UPYZRBRKD

nss/cmd/bltest/tests/sha3_384/plaintext1

@@ -0,0 +1 @@
+Z13PMSNAM542GHFNBPV12TJHDNF63WY2

nss/cmd/bltest/tests/sha3_512/ciphertext0

@@ -0,0 +1,2 @@
+NWdFNsaq+p0m6999OGSEgOu7XxK6aAz8On5IhE4ebC07C0PAJTcZ/Y3AUt5bvQXCEw3vXsFGqaPn
+GvtAwbcvpg==

nss/cmd/bltest/tests/sha3_512/ciphertext1

@@ -0,0 +1,2 @@
+LO9UaCHnbFW7D1Lofc3MKDTzJMaiLPySWTgcOBohj16AP8V65V5DsRzUCQq7BvJ+2DtXbsX8wRMv
+sXDjNNyVJw==

nss/cmd/bltest/tests/sha3_512/numtests

@@ -0,0 +1 @@
+2

nss/cmd/bltest/tests/sha3_512/plaintext0

@@ -0,0 +1 @@
+BU66CYFKPPT6LLPIYLJOCZ5QZP5IB2FM

nss/cmd/bltest/tests/sha3_512/plaintext1

@@ -0,0 +1 @@
+T18RE9CFOLCHXPYCZMKSCUIKX3MCT6FY

nss/cmd/digest/digest.c

@@ -34,6 +34,30 @@ HashTypeToOID(HASH_HashType hashtype)
         case HASH_AlgSHA1:
             hashtag = SEC_OID_SHA1;
             break;
+        case HASH_AlgSHA256:
+            hashtag = SEC_OID_SHA256;
+            break;
+        case HASH_AlgSHA384:
+            hashtag = SEC_OID_SHA384;
+            break;
+        case HASH_AlgSHA512:
+            hashtag = SEC_OID_SHA512;
+            break;
+        case HASH_AlgSHA224:
+            hashtag = SEC_OID_SHA224;
+            break;
+        case HASH_AlgSHA3_224:
+            hashtag = SEC_OID_SHA3_224;
+            break;
+        case HASH_AlgSHA3_256:
+            hashtag = SEC_OID_SHA3_256;
+            break;
+        case HASH_AlgSHA3_384:
+            hashtag = SEC_OID_SHA3_384;
+            break;
+        case HASH_AlgSHA3_512:
+            hashtag = SEC_OID_SHA3_512;
+            break;
         default:
             fprintf(stderr, "A new hash type has been added to HASH_HashType.\n");
             fprintf(stderr, "This program needs to be updated!\n");
@@ -91,7 +115,7 @@ static int
 DigestFile(FILE *outFile, FILE *inFile, SECOidData *hashOID)
 {
     int nb;
-    unsigned char ibuf[4096], digest[32];
+    unsigned char ibuf[4096], digest[HASH_LENGTH_MAX];
     PK11Context *hashcx;
     unsigned int len;
     SECStatus rv;
@@ -124,7 +148,7 @@ DigestFile(FILE *outFile, FILE *inFile, SECOidData *hashOID)
         }
     }
 
-    rv = PK11_DigestFinal(hashcx, digest, &len, 32);
+    rv = PK11_DigestFinal(hashcx, digest, &len, HASH_LENGTH_MAX);
     PK11_DestroyContext(hashcx, PR_TRUE);
 
     if (rv != SECSuccess)
@@ -209,6 +233,7 @@ main(int argc, char **argv)
         outFile = stdout;
 
     hashOID = HashNameToOID(hashName);
+    free(hashName);
     if (hashOID == NULL) {
         fprintf(stderr, "%s: invalid digest type\n", progName);
         Usage(progName);

nss/doc/rst/build.rst

@@ -79,7 +79,7 @@ Building NSS
 
       NSS compilation on Windows uses the same shared build system as Mozilla
       Firefox. You must first install the `Windows Prerequisites
-      <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites>`__,
+      <https://firefox-source-docs.mozilla.org/setup/windows_build.html>`__,
       including **MozillaBuild**.
 
       You can also build NSS on the Windows Subsystem for Linux, but the resulting binaries aren't

nss/doc/rst/index.rst

@@ -12,7 +12,6 @@ Network Security Services (NSS)
    build_artifacts.rst
    releases/index.rst
    community.rst
-   legacy/index.rst
 
 .. warning::
    This NSS documentation was just imported from our legacy MDN repository. It

nss/doc/rst/legacy/building/index.rst

@@ -19,12 +19,12 @@ Building NSS
 
 .. container::
 
-   NSS needs a C and C++ compiler.  It has minimal dependencies, including only standard C and C++
+   NSS needs a C and C++ compiler. It has minimal dependencies, including only standard C and C++
    libraries, plus `zlib <https://www.zlib.net/>`__.
 
-   For building, you also need `make <https://www.gnu.org/software/make/>`__.  Ideally, also install
+   For building, you also need `make <https://www.gnu.org/software/make/>`__. Ideally, also install
    `gyp <https://gyp.gsrc.io/>`__ and `ninja <https://ninja-build.org/>`__ and put them on your
-   path.  This is recommended, as the build is faster and more reliable.
+   path. This is recommended, as the build is faster and more reliable.
 
 `Windows <#windows>`__
 ~~~~~~~~~~~~~~~~~~~~~~
@@ -33,7 +33,7 @@ Building NSS
 
    NSS compilation on Windows uses the same shared build system as Mozilla Firefox. You must first
    install the `Windows
-   Prerequisites <https://developer.mozilla.org/en-US/docs/Mozilla/Developer_guide/Build_Instructions/Windows_Prerequisites>`__,
+   Prerequisites <https://firefox-source-docs.mozilla.org/setup/windows_build.html>`__,
    including **MozillaBuild**.
 
    You can also build NSS on the Windows Subsystem for Linux, but the resulting binaries aren't
@@ -78,7 +78,7 @@ Building NSS
 .. container::
 
    Alternatively, there is a ``make`` target called "nss_build_all", which produces a similar
-   result.  This supports some alternative options, but can be a lot slower.
+   result. This supports some alternative options, but can be a lot slower.
 
    .. code::
 
@@ -113,7 +113,7 @@ Building NSS
 
 .. container::
 
-   NSS contains extensive unit tests.  Scripts to run these are found in the ``tests`` directory. 
+   NSS contains extensive unit tests. Scripts to run these are found in the ``tests`` directory.
    Run the standard suite by:
 
    .. code::
@@ -152,7 +152,7 @@ Building NSS
 
    Running all tests can take a considerable amount of time.
 
-   Test output is stored in ``tests_results/security/$HOST.$NUMBER/``.  The file ``results.html``
+   Test output is stored in ``tests_results/security/$HOST.$NUMBER/``. The file ``results.html``
    summarizes the results, ``output.log`` captures all the test output.
 
    Other subdirectories of ``nss/tests`` contain scripts that run a subset of the full suite. Those