Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package mozilla-nss for openSUSE:Factory checked in at 2026-11-06 19:34:46 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/mozilla-nss (Old) and /work/SRC/openSUSE:Factory/.mozilla-nss.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "mozilla-nss" Fri Nov 6 19:34:46 2026 rev:249 rq:1395161 version:3.132 Changes: -------- --- /work/SRC/openSUSE:Factory/mozilla-nss/mozilla-nss.changes 2026-10-20 12:36:04.302877581 +0200 +++ /work/SRC/openSUSE:Factory/.mozilla-nss.new.3759290/mozilla-nss.changes 2026-11-06 19:38:08.130354552 +0100 @@ -1,0 +2,123 @@ +Thu Oct 22 03:04:18 UTC 2026 - Bjørn Lie <[email protected]> + +- Update to version 3.132: + * bmo#2084101 - Remove eMudhra emSign Root CA - G3 from NSS. + * bmo#2083709 - Remove eMudhra emSign Root CA - C1 and emSign ECC Root CA - + C3 from NSS. + * bmo#2056777 - fix build failures. + * bmo#2056777 - secasn1d: propagate end-of-contents flag to enclosing + construct. + * bmo#2056777 - additional secasn1d tests for end of contents handling. + * bmo#2056777 - Changing the end_of_content for BER encoding. + * bmo#2064148 - run the FIPS-mode SSL tests in CI. + * bmo#2064148 - run fips.sh in CI. + * bmo#2064148 - run gtests in FIPS mode. + * bmo#2082675 - do not force-import an empty symmetric key. + * bmo#2082671 - allow unwrapping an EC private key without a public point. + * bmo#2064426 - DTLS1.3 must not use EndOfEarlyData (per RFC 9147 Section + 5.6). + * bmo#2081444 - make clang-cl the default compiler for Windows in CI. + * bmo#2081444 - add option to build with clang-cl in CI. + * bmo#2075015 - prefer the seed format for wrapped ML-KEM and ML-DSA private + keys. + * bmo#2074404 - Encode ML-DSA private keys in PK11_ExportPrivKeyInfo. + * bmo#2074404 - Encode ML-KEM private keys in PK11_ExportPrivKeyInfo. + * bmo#2081440 - use nspr4 branch tip for CI runs. + * bmo#2082406 - Read p7env and p7verify input in binary mode on Windows. + * bmo#2082407 - p7verify, p7content: exit non-zero on invalid signatures; fix + p7verify SHA-384/512 digests. + * bmo#2050941 - libpkix http default client tests. + * bmo#2079860 - clear held back early data byte when 0rtt is rejected. + * bmo#2030245 - add Windows ARM64 CI jobs. + * bmo#2079416 - Update the wycheproof testvectors README. + * bmo#2079416 - Update ML-KEM wycheproof testvectors. + * bmo#2079416 - Update ML-DSA wycheproof testvectors. + * bmo#2079416 - Update DSA wycheproof testvectors. + * bmo#2079416 - Update RSA PKCS#1 v1.5 signature wycheproof testvectors. + * bmo#2079416 - Update RSA-PSS wycheproof testvectors. + * bmo#2079416 - Update RSA PKCS#1 v1.5 decryption wycheproof testvectors. + * bmo#2079416 - Update RSA-OAEP wycheproof testvectors. + * bmo#2079416 - Update EdDSA wycheproof testvectors. + * bmo#2079416 - Update ChaCha20-Poly1305 wycheproof testvectors. + * bmo#2079416 - Update ECDSA wycheproof testvectors. + * bmo#2079416 - Update ECDH wycheproof testvectors. + * bmo#2079416 - Update X25519 wycheproof testvectors. + * bmo#2079416 - Update HMAC wycheproof testvectors. + * bmo#2079416 - Update AES-CMAC wycheproof testvectors. + * bmo#2079416 - Update AES-CBC wycheproof testvectors. + * bmo#2079402 - read JSON directly for all wycheproof tests. + * bmo#2079457 - explicitly reject RSA PKCS#1 v1.5 ciphertexts that are not + less than the modulus. + * bmo#2075179 - finalize the PRAGMA table_info statement on error paths in + sdb_init. + * bmo#2076062 - Limit nesting depth in PKCS#12 safeContents decoder. + * bmo#2072757 - use encoded serial number to look up trust in + fill_CERTCertificateFields. + * bmo#2077359 - remove unused SEC_ASN1_MKSUB from secsign.c. + * bmo#1961826 - Run NSS_Shutdown at exit in SMIME fuzzer. + * bmo#1961826 - Add streaming decoder pass to SMIME fuzzer. + * bmo#1961826 - Verify SignerInfos in SMIME fuzzer. + * bmo#1961826 - Regenerate test certs for SMIME fuzzer. + * bmo#1961826 - Add EC cert for ECDH and decrypt key callback to SMIME fuzzer + * bmo#1961826 - Extend the SMIME fuzzer to cover more functions. + * bmo#390374 - return NULL for deprecated PBE functions. + * bmo#2061403 - Keep sigd->digests parallel to sigd->digestAlgorithms. + * bmo#2076696 - guard against integer overflow in PK11_HPKE_Seal and + PK11_HPKE_Open. + * bmo#2076037 - ensure chacha20-poly1305 tag buffer is 16 bytes in + PK11_AEADOp. + * bmo#2077359 - remove more unused functions from NSS. + * bmo#1960284 - Don't report epoch exhaustion through FatalError. +- Changes from version 3.131.1: + * This release removes trust in the following root certificates: + + bmo#2083709 - emSign Root CA - C1 + + bmo#2083709 - emSign ECC Root CA - C3 + + bmo#2084101 - emSign ECC Root CA - G3 +- Changes from version 3.131: + * bmo#2078438 - remove unused private pkcs12, pkcs7, and smime functions. + * bmo#2070738 - Fix generating nss.pc with system-nspr. + * bmo#2066048 - replace sslSecurityInfo peerCert with peerCertDER. + * bmo#2067244 - remove support for inherited DSA parameters in libssl. + * bmo#2017995 - Fix issues with Unwrapping keys using tokens in FIPS mode. + * bmo#2069886 - remove Windows-only AES-CTR implementation. + * bmo#2069887 - improve algorithm policy enforcement for ML-DSA. + * bmo#2064512 - reject non-RFC 8410 curve OIDs when encoding an X25519 or + Ed25519 SubjectPublicKeyInfo. + * bmo#2076212 - Clear freed CMS members in the destructors. + * bmo#2076212 - Release the previous signer certificate when re-verifying a + PKCS#7 signature. + * bmo#2076212 - Make SEC_PKCS7DecoderAbort fail the decode. + * bmo#2076212 - Fail closed after an incomplete PKCS#12 decode. + * bmo#2076240 - remove unused NSSCryptoContext and NSSTrustDomain functions. + * bmo#1993638 - can’t import eddsa .p12 from OpenSSL. + * bmo#2055638 - fix clang format. + * bmo#2072045 - pk12util fails to import private key into SoftHSM token + despite initialized slot and valid PKCS#12 file. + * bmo#2075580 - p7content: open output file in binary mode. + * bmo#2068388 - fix msvc build error. + * bmo#2072416 - use SEC_ASN1_GET for SEC_OctetStringTemplate in der_gtest. + * bmo#2074663 - remove unused and unexported CERT_ functions. + * bmo#2072416 - fix leak when decoding nested indefinite length octet strings + with null arena. + * bmo#2072416 - Keep ASN.1 constructed-string substring allocations out of + the caller’s SECItem. + * bmo#2075525 - link softoken_static_gtest against advapi32 on Windows. + * bmo#2055638 - add regression test for bug 2054616. + * bmo#2055583 - add regression test for bug 2054719. + * bmo#2075289 - httpserv: OCSP responses are sent without a Content-Length + header. + * bmo#2075021 - remove unused private PK11_ functions. + * bmo#2075291 - avoid NULL dereference in NSS_CMSDigestContext_StartMultiple + error path. + * bmo#2073293 - add CERT_GetDERCertTrust. + * bmo#1719827 - auto update key4db entry KDF iteration count on login. + * bmo#2068388 - reject RSA public exponents larger than 32 bits. + * bmo#2075024 - improve mach support for dist builds. + * bmo#2037628 - protect PK11SlotInfo::lastLoginCheck with + PK11SlotInfo::nssTokenLock. + * bmo#2047771 - fix fips failures in debug builds. + * bmo#2068381 - fix error path double free of param_free in + PK11_UnwrapPrivKey. + * bmo#2074968 - stub out DER_Lengths. + +------------------------------------------------------------------- Old: ---- nss-3.130.tar.gz New: ---- nss-3.132.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ mozilla-nss.spec ++++++ --- /var/tmp/diff_new_pack.PHTMTC/_old 2026-11-06 19:38:12.711546179 +0100 +++ /var/tmp/diff_new_pack.PHTMTC/_new 2026-11-06 19:38:12.712546221 +0100 @@ -40,9 +40,9 @@ %define origname mozilla-nss Name: %{origname}%{psuffix} -Version: 3.130 +Version: 3.132 Release: 0 -%define underscore_version 3_130 +%define underscore_version 3_132 Summary: Network Security Services License: MPL-2.0 Group: System/Libraries ++++++ nss-3.130.tar.gz -> nss-3.132.tar.gz ++++++ /work/SRC/openSUSE:Factory/mozilla-nss/nss-3.130.tar.gz /work/SRC/openSUSE:Factory/.mozilla-nss.new.3759290/nss-3.132.tar.gz differ: char 5, line 1
