Update to 3.11.4:

The following bugs have been fixed in NSS 3.11.4.

    * Bug 115951: freebl dynamic library is never unloaded by
      libsoftoken or libssl. Also tiny one-time leak in freebl's
      loader.c.
    * Bug 127960: SSL force handshake function should take a timeout.
    * Bug 335454: Unable to find library 'libsoftokn3.sl' on HP-UX 64 bit.
    * Bug 350200: Implement DHMAC based POP (ProofOfPossession).
    * Bug 351482: audit_log_user_message doesn't exist in all
      versions of libaudit.so.0. (the "paranoia patch")
    * Bug 352041: oom [@ CERT_DecodeDERCrlWithFlags] "extended"
      tracked as NULL was dereferenced.
    * Bug 353422: Klocwork bugs in nss/lib/crmf.
    * Bug 353475: Cannot run cmd tools compiled with VC++ 2005.
    * Bug 353572: leak in sftk_OpenCertDB.
    * Bug 353608: NSS_RegisterShutdown may fail, and appData argument
      to callbacks is always NULL.
    * Bug 353749: PowerUpSelf tests update for DSA and ECDSA KAT.
    * Bug 353896: Building tip with NSS_ECC_MORE_THAN_SUITE_B causes
      crashes in all.sh.
    * Bug 353910: memory leak in RNG_RNGInit.
    * Bug 354313: STAN_GetCERTCertificateName leaks "instance" struct.
    * Bug 354384: vfyserv shutdown failure when client auth requested.
    * Bug 354900: Audit modifications, accesses, deletions, and
      additions of cryptographic keys.
    * Bug 355297: Improve the very first RNG_RandomUpdate call.
    * Bug 356073: C_GetTokenInfo should return CKR_CRYPTOKI_NOT_INITIALIZED
      if not initialized.
    * Bug 356309: CertVerifyLog in CERT_VerifyCertificate terminates
      early on expired certs.
    * Bug 357197: OCSP response code fails to match CERTIds. (hot fix only)
    * Bug 359484: FireFox 2 tries to negotiate ECC cipher suites
      using ssl2 client hello. (hot fix only)
    * Bug 360818: No RPATH set for signtool and signver.

10 files changed, 43 insertions, 93 deletions

diff --git a/devel/nss/Makefile b/devel/nss/Makefile
index ee47b14de70..d58f993d4a3 100644
--- a/devel/nss/Makefile
+++ b/devel/nss/Makefile
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.19 2006/10/24 08:38:03 abs Exp $
+# $NetBSD: Makefile,v 1.20 2007/01/20 18:55:09 wiz Exp $
 
-DISTNAME=		nss-3.11
+DISTNAME=		nss-3.11.4
 CATEGORIES=		security
-MASTER_SITES=		ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_11_RTM/src/
+MASTER_SITES=		${MASTER_SITE_MOZILLA:=security/nss/releases/NSS_3_11_4_RTM/src/}
 
 MAINTAINER=		mjl@luckie.org.nz
 HOMEPAGE=		http://www.mozilla.org/projects/security/pki/nss/
@@ -42,10 +42,10 @@ NSS_OBJ_DIR=	${OPSYS}${OS_VERSION}_gcc_OPT.OBJ
 NSS_OBJ_DIR=	${OPSYS}${OS_VERSION}_OPT.OBJ
 .  endif
 
-# on solaris/sparc, we get a different set of libs.  
+# on solaris/sparc, we get a different set of libs.
 # How about NetBSD/sparc and sparc64?
 .  if ${MACHINE_ARCH} == "sparc"
-SUNOS_TRUE=	
+SUNOS_TRUE=
 SUNOS_FALSE=	"@comment "
 .  endif
 
@@ -64,7 +64,7 @@ NSS_OBJ_DIR=	${OPSYS}${NSS_SHORT_OS_VERSION}${NSS_MACHINE_ARCH}_glibc_PTH_OPT.OB
 .endif
 
 SUNOS_TRUE?=	"@comment "
-SUNOS_FALSE?=	
+SUNOS_FALSE?=
 PLIST_SUBST+=	SUNOS_TRUE=${SUNOS_TRUE}
 PLIST_SUBST+=	SUNOS_FALSE=${SUNOS_FALSE}
 
diff --git a/devel/nss/PLIST b/devel/nss/PLIST
index de5481e6915..c6495db5b1e 100644
--- a/devel/nss/PLIST
+++ b/devel/nss/PLIST
@@ -1,8 +1,7 @@
-@comment $NetBSD: PLIST,v 1.6 2006/10/24 08:54:08 abs Exp $
+@comment $NetBSD: PLIST,v 1.7 2007/01/20 18:55:09 wiz Exp $
 include/nss/dbm/cdefs.h
 include/nss/dbm/mcom_db.h
 include/nss/dbm/ncompat.h
-include/nss/dbm/nsres.h
 include/nss/dbm/winfile.h
 include/nss/nss/base64.h
 include/nss/nss/blapit.h
diff --git a/devel/nss/distinfo b/devel/nss/distinfo
index ca8d16dcc0d..40a9b4f7fe0 100644
--- a/devel/nss/distinfo
+++ b/devel/nss/distinfo
@@ -1,15 +1,14 @@
-$NetBSD: distinfo,v 1.16 2006/11/20 17:06:03 riz Exp $
+$NetBSD: distinfo,v 1.17 2007/01/20 18:55:09 wiz Exp $
 
-SHA1 (nss-3.11.tar.gz) = 0abccde9a351fb9fa662c75754eb980e04fad482
-RMD160 (nss-3.11.tar.gz) = 90be4b42e490084c23451ce8abcf089150357d1e
-Size (nss-3.11.tar.gz) = 5002908 bytes
-SHA1 (patch-aa) = d2b5f4213c35e667866279f398fe9297232d27d1
+SHA1 (nss-3.11.4.tar.gz) = fc032211f38bd3b688b75f3bdf36a32a23e4abd2
+RMD160 (nss-3.11.4.tar.gz) = 5047c7f56444b22bc5f64dbaa02576e48ab5ef2a
+Size (nss-3.11.4.tar.gz) = 3713920 bytes
+SHA1 (patch-aa) = 25b1442791326ba3b4c5cfa299c7a453c77e457e
 SHA1 (patch-ab) = 371e04afd51d4182a1324cbd04c1d93bdbb8949a
-SHA1 (patch-ae) = 1f4982d77ddf7dbf708ebc5a1737345010dddbf9
+SHA1 (patch-ae) = 71c90bac798706a38634a2883bd1541d76d01861
 SHA1 (patch-af) = c0e5a68911eb6503224c569552a5e94cfa036364
 SHA1 (patch-ag) = ead4d79ac6ebe718230ce47fb3e296b2b4f7584b
-SHA1 (patch-ah) = 01e8644a0a1dfc70985aed213fc753f376560865
-SHA1 (patch-ai) = 995add5e536bb0fba425295cc7972b8725f4e10d
-SHA1 (patch-ak) = 4816bf73acfa3edcd0a74d0e235eee7974b42dd6
-SHA1 (patch-al) = 711ae5b0ed4a5b8dd8e3735b25fcc5419c27e63e
-SHA1 (patch-an) = 2ee154aff8a0b5a968718d52dcf20e345e2f2373
+SHA1 (patch-ah) = fa302e20163db73a1453b4e360f7f55377b7bea2
+SHA1 (patch-ai) = 80a18536703d7f01b28448e503f49da50b07304e
+SHA1 (patch-ak) = 371eb96e2874ef8ec841dc886a70f2b5215f701d
+SHA1 (patch-an) = c9d8f350488cc383a0e9bd25b69b270f678c4736
diff --git a/devel/nss/patches/patch-aa b/devel/nss/patches/patch-aa
index 76dc6ab00f1..8fada7fcd55 100644
--- a/devel/nss/patches/patch-aa
+++ b/devel/nss/patches/patch-aa
@@ -1,13 +1,13 @@
-$NetBSD: patch-aa,v 1.2 2006/07/12 15:38:29 rillig Exp $
+$NetBSD: patch-aa,v 1.3 2007/01/20 18:55:09 wiz Exp $
 
---- mozilla/security/nss/Makefile.orig	Tue Jan  4 21:17:13 2005
-+++ mozilla/security/nss/Makefile	Tue Jan  4 21:17:25 2005
-@@ -74,7 +74,7 @@
+--- mozilla/security/nss/Makefile.orig	2006-04-14 22:48:17.000000000 +0000
++++ mozilla/security/nss/Makefile
+@@ -78,7 +78,7 @@ include $(CORE_DEPTH)/coreconf/rules.mk
  # (7) Execute "local" rules. (OPTIONAL).                              #
  #######################################################################
  
 -nss_build_all: build_coreconf build_nspr build_dbm all
 +nss_build_all: build_coreconf build_dbm all
  
- build_coreconf:
- 	cd $(CORE_DEPTH)/coreconf ;  $(MAKE)
+ nss_clean_all: clobber_coreconf clobber_nspr clobber_dbm clobber
+ 
diff --git a/devel/nss/patches/patch-ae b/devel/nss/patches/patch-ae
index 4722db8aa07..98b0b8b43a3 100644
--- a/devel/nss/patches/patch-ae
+++ b/devel/nss/patches/patch-ae
@@ -1,8 +1,8 @@
-$NetBSD: patch-ae,v 1.4 2006/07/12 16:30:04 rillig Exp $
+$NetBSD: patch-ae,v 1.5 2007/01/20 18:55:09 wiz Exp $
 
---- mozilla/security/nss/cmd/platlibs.mk.orig	2005-11-15 19:19:18.000000000 +0100
-+++ mozilla/security/nss/cmd/platlibs.mk	2006-07-12 17:53:02.000000000 +0200
-@@ -172,7 +172,7 @@ endif
+--- mozilla/security/nss/cmd/platlibs.mk.orig	2006-11-17 02:13:16.000000000 +0000
++++ mozilla/security/nss/cmd/platlibs.mk
+@@ -213,7 +213,7 @@ endif
  # If GNU ld is used, we must use the -rpath-link option to tell
  # the linker where to find libsoftokn3.so, an implicit dependency
  # of libnss3.so.
@@ -11,7 +11,7 @@ $NetBSD: patch-ae,v 1.4 2006/07/12 16:30:04 rillig Exp $
  EXTRA_SHARED_LIBS += -Wl,-rpath-link,$(DIST)/lib
  endif
  
-@@ -213,6 +213,7 @@ EXTRA_SHARED_LIBS += \
+@@ -236,6 +236,7 @@ EXTRA_SHARED_LIBS += \
  	-L$(DIST)/lib \
  	-lssl3 \
  	-lsmime3 \
diff --git a/devel/nss/patches/patch-ah b/devel/nss/patches/patch-ah
index 368c2e50630..3a6e26d6f4a 100644
--- a/devel/nss/patches/patch-ah
+++ b/devel/nss/patches/patch-ah
@@ -1,8 +1,8 @@
-$NetBSD: patch-ah,v 1.2 2006/07/12 15:38:29 rillig Exp $
+$NetBSD: patch-ah,v 1.3 2007/01/20 18:55:09 wiz Exp $
 
---- mozilla/security/coreconf/config.mk.orig	2005-08-12 12:23:06.000000000 -0700
-+++ mozilla/security/coreconf/config.mk	2005-08-12 12:22:42.000000000 -0700
-@@ -59,7 +59,7 @@
+--- mozilla/security/coreconf/config.mk.orig	2006-04-28 03:36:22.000000000 +0000
++++ mozilla/security/coreconf/config.mk
+@@ -63,7 +63,7 @@ endif
  #######################################################################
  
  TARGET_OSES = FreeBSD BSD_OS NetBSD OpenUNIX OS2 QNX Darwin BeOS OpenBSD \
diff --git a/devel/nss/patches/patch-ai b/devel/nss/patches/patch-ai
index 507bcc8519d..f9974f00c6f 100644
--- a/devel/nss/patches/patch-ai
+++ b/devel/nss/patches/patch-ai
@@ -1,8 +1,8 @@
-$NetBSD: patch-ai,v 1.2 2006/07/12 15:38:29 rillig Exp $
+$NetBSD: patch-ai,v 1.3 2007/01/20 18:55:09 wiz Exp $
 
---- mozilla/dbm/src/mktemp.c.orig	2005-08-12 12:24:10.000000000 -0700
-+++ mozilla/dbm/src/mktemp.c	2005-08-12 12:24:59.000000000 -0700
-@@ -100,7 +100,7 @@
+--- mozilla/dbm/src/mktemp.c.orig	2003-01-20 23:13:37.000000000 +0000
++++ mozilla/dbm/src/mktemp.c
+@@ -98,7 +98,7 @@ mktemp(char *path)
  static int 
  _gettemp(char *path, register int *doopen, int extraFlags)
  {    
diff --git a/devel/nss/patches/patch-ak b/devel/nss/patches/patch-ak
index 47bf2a84c72..f44525c51ae 100644
--- a/devel/nss/patches/patch-ak
+++ b/devel/nss/patches/patch-ak
@@ -1,8 +1,8 @@
-$NetBSD: patch-ak,v 1.2 2006/07/12 15:38:29 rillig Exp $
+$NetBSD: patch-ak,v 1.3 2007/01/20 18:55:09 wiz Exp $
 
---- mozilla/security/coreconf/arch.mk.orig	2006-01-15 15:59:33.000000000 +0000
+--- mozilla/security/coreconf/arch.mk.orig	2005-07-07 16:50:47.000000000 +0000
 +++ mozilla/security/coreconf/arch.mk
-@@ -141,7 +141,7 @@ endif
+@@ -146,7 +146,7 @@ endif
  # IRIX 6.5-ALPHA-1289139620.
  #
  
diff --git a/devel/nss/patches/patch-al b/devel/nss/patches/patch-al
deleted file mode 100644
index 1b42618820b..00000000000
--- a/devel/nss/patches/patch-al
+++ /dev/null
@@ -1,27 +0,0 @@
-$NetBSD: patch-al,v 1.3 2006/07/12 15:38:29 rillig Exp $
-
-Since GNU Make 3.81, the backslashes are preserved in the shell commands
-and need to be filtered out explicitly.
-
---- mozilla/security/coreconf/rules.mk.orig	2004-03-23 01:56:47.000000000 +0100
-+++ mozilla/security/coreconf/rules.mk	2006-06-24 10:20:21.000000000 +0200
-@@ -882,7 +882,7 @@
- ifneq (,$(filter-out OpenVMS OS2 WIN%,$(OS_TARGET)))
- # Can't use sed because of its 4000-char line length limit, so resort to perl
- .DEFAULT:
--	@perl -e '                                                            \
-+	@perlcmd='                                                            \
- 	    open(MD, "< $(DEPENDENCIES)");                                    \
- 	    while (<MD>) {                                                    \
- 		if (m@ \.*/*$< @) {                                           \
-@@ -909,7 +909,9 @@
- 	    } elsif ("$<" ne "$(DEPENDENCIES)") {                             \
- 		print "$(MAKE): *** No rule to make target $<.  Stop.\n";     \
- 		exit(1);                                                      \
--	    }'
-+	    }'; \
-+	perlcmd=`echo "$$perlcmd" | sed -e 's,\\\\$$,,'`; \
-+	perl -e "$$perlcmd"
- endif
- 
- #############################################################################
diff --git a/devel/nss/patches/patch-an b/devel/nss/patches/patch-an
index 4e137c3cb28..1f6484ce715 100644
--- a/devel/nss/patches/patch-an
+++ b/devel/nss/patches/patch-an
@@ -1,4 +1,4 @@
-$NetBSD: patch-an,v 1.2 2006/10/22 15:32:47 dmcmahill Exp $
+$NetBSD: patch-an,v 1.3 2007/01/20 18:55:09 wiz Exp $
 
 https://bugzilla.mozilla.org/show_bug.cgi?id=323977
 https://bugzilla.mozilla.org/attachment.cgi?id=209007&action=view
@@ -10,10 +10,10 @@ flags used by the solaris assembler which is explicitly called out in
 the makefile in a couple of places.  This prevents errors when trying to
 assemble files which contain cpu specific instructions.
 
---- mozilla/security/nss/lib/freebl/Makefile.orig	2005-11-22 02:13:32.000000000 -0500
+--- mozilla/security/nss/lib/freebl/Makefile.orig	2006-08-23 22:57:26.000000000 +0000
 +++ mozilla/security/nss/lib/freebl/Makefile
-@@ -188,6 +188,17 @@ endif
- endif
+@@ -196,6 +196,17 @@ ifeq (,$(filter-out BSD_OS FreeBSD Linux
+     MKSHLIB += -Wl,-Bsymbolic
  endif
  
 +# The blapi functions are defined not only in the freebl shared
@@ -30,24 +30,3 @@ assemble files which contain cpu specific instructions.
  ifeq ($(OS_TARGET),SunOS)
  
  # The -R '$ORIGIN' linker option instructs this library to search for its
-@@ -227,16 +238,20 @@ ifeq ($(CPU_ARCH),sparc)
- 	endif
- 	ifdef USE_ABI32_INT64
- 	    ARCHFLAG=-mcpu=v9 -Wa,-xarch=v8plus
-+	    SOLARIS_AS_FLAGS = -xarch=v8plus -K PIC
- 	endif
- 	ifdef USE_ABI32_FPU
- 	    ARCHFLAG=-mcpu=v9 -Wa,-xarch=v8plus
-+	    SOLARIS_AS_FLAGS = -xarch=v8plusa -K PIC
- 	endif # USE_ABI32_FPU
- 	ifdef USE_ABI64_INT
- 	    # this builds for Sparc v9a pure 64-bit architecture
-+	    SOLARIS_AS_FLAGS = -xarch=v9 -K PIC
- 	endif
- 	ifdef USE_ABI64_FPU
- 	    # this builds for Sparc v9a pure 64-bit architecture
- 	    # It uses floating point, and 32-bit word size
-+	    SOLARIS_AS_FLAGS = -xarch=v9a -K PIC
- 	endif
-     else # NS_USE_GCC
- 	ifdef USE_ABI32_INT32