c5e7af92eb
Fixes CVE-2023-5388
Also update README, and remove obsolete documentation of Debian's
mangled SONAME; relevant Debian changelog:
nss (2:3.13.4-2) unstable; urgency=low
* debian/control, debian/libnss3*, debian/rules,
mozilla/security/coreconf/*, mozilla/security/nss/lib/*/manifest.mn:
Move to unversioned library. ABI compatibility is ensured upstream, and
the SO version, if it needed a change at any time, would be a change in
the library name. There is no reason to keep making compatibility more
difficult with other distros and upstream binary releases. While previous
versions were one-way compatible (binaries built against other distros or
upstream nspr could work on Debian), this approach works both ways.
-- Mike Hommey <glandium@debian.org> Thu, 17 May 2012 09:45:36 +0200
Change-Id: Ifc1eae68827fa88ae001a3903c8555af67b488ac
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163482
Tested-by: Michael Stahl <michael.stahl@allotropia.de>
Reviewed-by: Michael Stahl <michael.stahl@allotropia.de>
33 lines
1.2 KiB
Text
33 lines
1.2 KiB
Text
Contains the Network Security Services (NSS) libraries from Mozilla
|
|
|
|
== ESR versions ==
|
|
|
|
Upstream releases both regular and "ESR" versions, the latter go into Firefox
|
|
ESR and Thunderbird.
|
|
|
|
There is a new ESR version about once a year, and a ESR version gets micro
|
|
updates only when there are security issues to fix, and it's not always obvious
|
|
from the release notes of a regular release if there are security issues that
|
|
are relevant to LibreOffice, hence it's probably best to bundle only the ESR
|
|
versions and upgrade for every micro release (as recommended by upstream).
|
|
|
|
== Fips 140 and signed libraries ==
|
|
|
|
Fips 140 mode is not supported. That is, the *.chk files containing the
|
|
checksums for the cryptographic module are not delivered into instdir and will
|
|
not be part of the OOo installation sets.
|
|
|
|
Signing has been turned off because
|
|
- we change the rpath (install names) after signing which breaks the signatures
|
|
(Mac)
|
|
- sqlite conflicts with the system sqlite when signing which breaks the build
|
|
|
|
See also
|
|
[https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Tech_Notes/nss_tech_note6]
|
|
|
|
== libsqlite3 ==
|
|
|
|
With all supported macOS SDK we use
|
|
NSS_USE_SYSTEM_SQLITE=1
|
|
to build using the system sqlite.
|
|
|