From e18e949bffac26a3e37bbc8e05e04095db719984 Mon Sep 17 00:00:00 2001
From: Liwei Ge <geliwei@openanolis.org>
Date: Thu, 11 Feb 2021 08:54:01 +0800
Subject: [PATCH] build: renew two chains libpkix test certificates

https://github.com/nss-dev/nss/commit/e24c7f21749e4d203e0e0f8a3433ca021ae11bda

Signed-off-by: Liwei Ge <geliwei@openanolis.org>
Change-Id: Ide40fcbed416d86363267393380a97a727ab7191
---
 NameConstraints.ipaca.cert | Bin 0 -> 1000 bytes
 NameConstraints.ocsp1.cert | Bin 0 -> 956 bytes
 nss.spec                   |  11 +++++++++--
 3 files changed, 9 insertions(+), 2 deletions(-)
 create mode 100644 NameConstraints.ipaca.cert
 create mode 100644 NameConstraints.ocsp1.cert

diff --git a/NameConstraints.ipaca.cert b/NameConstraints.ipaca.cert
new file mode 100644
index 0000000000000000000000000000000000000000..4a451f3429d25ab6d3a9cb00b2f005118f7cac08
GIT binary patch
literal 1000
zcmXqLVt!)K#B^o>GZP~d6DPy|^k+KryEhsc@Un4gwRyCC=VfH%W@Rw&GL$xuWMd9x
z;Sv_|3~<!*@ppFgQ7|$vGBhwWGBD&e-~>ss2{VNT8_F5TfH=&;qRy#BC7EfN$%!SY
z3XY{E8Tmz-C6xvW;=EvOMg|6kmc}Mg68uIWGmMNZp#oI3t%*?y*)xo+49rc8{0s(7
zj9g4jjEoG=^1s)l`)r?{?G*K{efrz@^y51jSY#?Qrv7h?HS|xJwyR@Kb#XoSS;k@`
zsnyQM3ryGy#WsHSVY$Dg^{G_h`%Mr31m-(W;crQ1^qduS#_$YF{p|^7gJ%S~&q!HW
zm(3G@CaCp?<;oYmA#W!&GCx=N{6P0c-oNwp#+pmdoLYZ0GCC^kL&QoMpHn;Sj(>Qe
z^hQm=O0D0%H-6Ih3kIU0fhJcnWwxL0RlXc-l2#_+w#?P(S@YRe@9B#!@pBZMNXePs
z#64l9Oa=R2fe+QeDM|AR{Ml+s&wNX=u{yg}=;L43N9z-pu=4KysD4%b=6dyoUg<0!
z52apDsQdXg`^iRm&1dslnV1<F7#BC5GH5(*zypjoSz#7d17=3X{|2%k9v_Psi-^sH
zi!Zxc-CjtXDEVu|>eyHr_^;KV3M8$}QfyGzfK|alza>7@jL9aX)Co#pvT{I2vIrRn
zEZ{TXY2wn$EJ)PL$xlwqL5^-<+66{8BSWu1di8`|O}m!dVwtxpYDH(l^O)n^EA4l3
z2Rcm5V9HPnT;@5OTT`YgmH*njX#oeAOsrSN+As3`-O|vv$fQhr`L8dpcAUF7(@-ym
zp*GO$s#)TcbR|ob^_L{HZ|84+p?QqM+2n2c1(x(BcbIl*#%b-UdvaBi_t0<N_q$hp
z`d>78nTmLQ-nt@LY0vHRrzwT}_?+z8Sn%C=^~-miMw^$+=01`oQa<@mMQC2xlwb3s
zR5$K8d`&sC<Z{H~&IqqdBBEWV{@i{cGUZ(Q)<c#vi!KMAN*2}IW;jd#lT7cn#>uu8
oe}au0v=w%&75+F|gzv*HC4Yeh^Q0HMr%t--6)E;wBf+r-0MfH^bpQYW

literal 0
HcmV?d00001

diff --git a/NameConstraints.ocsp1.cert b/NameConstraints.ocsp1.cert
new file mode 100644
index 0000000000000000000000000000000000000000..817faafe3d2b5cd197a5c1dbeaf1db48ff37e689
GIT binary patch
literal 956
zcmXqLV%}lU#I#@mGZP~d6C<AiFB_*;n@8JsUPeZ4Rt5tvLums^Hs(+kE@2_h07pF^
ze`iM@1tS9^Ljyx214C{DPLL#<FjHu-p`3vXh{G%_>YQ3sl9`s7oLG{o;8<FckzbTq
zQfZ(d&I{HC)NN#FY!M~FZ)5~C!^prCDq!G@Y9L;##SKIuw(<Ep2L~u5=A|fj1_Zl0
z8#FO0A^U=nm4Ug5k)Hu5&c)Qk$jESNh9H+_`=WNQg?pt+eyBa#f0Dt~!(pf5h6$d*
zCsh`A&6Ow(Ouu`l{*?X_&6l6+-^-TOhG|)APYBhT_*yKJXGi3bU*1LznRBKbmHe*p
z*6~BLyubd-`a^;?OAj206$$+z&%1}WEHAPDKpyj?FJIPd=WRJ1BYE=K!<CJ3*J5Ot
zs*6l=?p`<8WdD)j>Ac;~-c6dZEaac<<uAR#x_+vU<}H`LdwGl3)~)<{>eaGrw!hs1
zgg3m&C^9fMpJc|U*m+dr%fr>x(`6WMAJORRJm<6F&-=_Tr;4sQRNqM5+4iER$MVO7
zwChE|+i&@vdEGD0{JLUa1aD?9_r2PEpCo3@TRCO!V<u)s2FAsWYYiG#fn!frn1#uJ
z!GI4KnzH<ijQ?3!n3>oP7$|`Fsvy3Yfe0IiHX9==D?2kMoW*V+3sS+yBE}-3Iz=Hn
zCpT)Eh^%<Dp_uFjshq?e2G%g8jEpS$2D%2?Funm}n|ww|Nr9EVer7?UZgQd?kkZS^
zPfpCyPfpa&PcAMn;Ai86*l57W%EAOph^Xlj7^92~JNE9FDY0Nzg!wzi4bzt$J+?2L
zw`)<UcIyLvordxYZypHE_;x3+NLQnCXUq9FH>UCNYsNQno#Yh1#I<RS%r58f_Uww)
z311APmvOS3oZ);-@ba7PJRSMdrw*QLF<g?dAn9cK<mUfotf!AZYH44*?s4}#(GA)v
z#V71_9xXdl>3Hpy*TuuT*d88?4VfwNLUQ`o&2f9Ir#WocdfMjS#%!<h6lcdJtBkvr
zZ+W;}HDEgb+Rv`K+<M}&zuX$^qrbntbNmU5z0?1zPd!h~+v%ySc7ES~y`%CKuPxqK
vMps(vMjNSSC6$HV517@Gyyu`~$MngkA8c=z6N#P`Q1tN0;&PF0A@=|PwAobl

literal 0
HcmV?d00001

diff --git a/nss.spec b/nss.spec
index 3f000bc..f47c185 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,3 +1,4 @@
+%define anolis_release .0.1
 %global nspr_build_version 4.25.0
 %global nspr_version 4.25.0
 %global nss_version 3.67.0
@@ -47,7 +48,7 @@ rpm.define(string.format("nss_release_tag NSS_%s_RTM",
 Summary:          Network Security Services
 Name:             nss
 Version:          %{nss_version}
-Release:          7%{?dist}
+Release:          7%{anolis_release}%{?dist}
 License:          MPLv2.0
 URL:              http://www.mozilla.org/projects/security/pki/nss/
 Requires:         nspr >= %{nspr_version}
@@ -94,6 +95,8 @@ Source26:         key4.db.xml
 Source27:         secmod.db.xml
 Source28:         nss-p11-kit.config
 Source30:         PayPalEE.cert
+Source31:         NameConstraints.ipaca.cert
+Source32:         NameConstraints.ocsp1.cert
 
 # To inject hardening flags for DSO
 Patch1:           nss-dso-ldflags.patch
@@ -161,7 +164,6 @@ Patch300:         nss-3.67-cve-2021-43527.patch
 Patch301:         nss-3.67-cve-2021-43527-test.patch
 
 
-
 %description
 Network Security Services (NSS) is a set of libraries designed to
 support cross-platform development of security-enabled client and
@@ -290,6 +292,8 @@ Header and library files for doing development with Network Security Services.
 %prep
 %autosetup -N -n %{name}-%{nss_archive_version}
 pushd nss
+cp -a %{SOURCE31} tests/libpkix/certs/
+cp -a %{SOURCE32} tests/libpkix/certs/
 %autopatch -p1
 popd
 
@@ -932,6 +936,9 @@ update-crypto-policies --no-reload &> /dev/null || :
 
 
 %changelog
+* Mon Dec 6 2021 Liwei Ge <geliwei@openanolis.org> - 3.67.0-7.0.1
+- Renew two chains libpkix test certificates
+
 * Thu Nov 18 2021 Bob Relyea <rrelyea@redhat.com> - 3.67.0-7
 - Fix CVE 2021 43527
 
-- 
Gitee