[PATCH] nss: 3.45 -> 3.47.1

[PATCH] nss: 3.45 -> 3.47.1

[Wang Mingyu]

Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
---
 meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} (98%)

diff --git a/meta/recipes-support/nss/nss_3.45.bb b/meta/recipes-support/nss/nss_3.47.1.bb
similarity index 98%
rename from meta/recipes-support/nss/nss_3.45.bb
rename to meta/recipes-support/nss/nss_3.47.1.bb
index e89e7d6..f49a50a 100644
--- a/meta/recipes-support/nss/nss_3.45.bb
+++ b/meta/recipes-support/nss/nss_3.47.1.bb
@@ -33,8 +33,8 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
            file://system-pkcs11.txt \
            "
 
-SRC_URI[md5sum] = "f1752d7223ee9d910d551e57264bafa8"
-SRC_URI[sha256sum] = "112f05223d1fde902c170966bfc6f011b24a838be16969b110ecf2bb7bc24e8b"
+SRC_URI[md5sum] = "1c32c2e89958e8255a6da1ea43ea8206"
+SRC_URI[sha256sum] = "1ae3d1cb1de345b258788f2ef6b10a460068034c3fd64f42427a183d8342a6fb"
 
 UPSTREAM_CHECK_URI = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_Releases"
 UPSTREAM_CHECK_REGEX = "NSS_(?P<pver>.+)_release_notes"
-- 
2.7.4

[PATCH] netbase: 5.6 -> 5.7

[Wang Mingyu]

netbase-add-rpcbind-as-an-alias-to-sunrpc.patch
Removed since it is included in 5.7

Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
---
 ...netbase-add-rpcbind-as-an-alias-to-sunrpc.patch | 46 ----------------------
 .../netbase/{netbase_5.6.bb => netbase_5.7.bb}     |  7 ++--
 2 files changed, 3 insertions(+), 50 deletions(-)
 delete mode 100644 meta/recipes-core/netbase/netbase/netbase-add-rpcbind-as-an-alias-to-sunrpc.patch
 rename meta/recipes-core/netbase/{netbase_5.6.bb => netbase_5.7.bb} (69%)

diff --git a/meta/recipes-core/netbase/netbase/netbase-add-rpcbind-as-an-alias-to-sunrpc.patch b/meta/recipes-core/netbase/netbase/netbase-add-rpcbind-as-an-alias-to-sunrpc.patch
deleted file mode 100644
index 27ba2f6..0000000
--- a/meta/recipes-core/netbase/netbase/netbase-add-rpcbind-as-an-alias-to-sunrpc.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 52d46c4d1fbd4c88d69c2fcf7837b2f2ba7ef6f2 Mon Sep 17 00:00:00 2001
-From: "Maxin B. John" <maxin.john@intel.com>
-Date: Thu, 12 Jan 2017 16:50:58 +0200
-Subject: [PATCH] netbase: add rpcbind as an alias to sunrpc
-
-the patch comes from:
-https://bugs.archlinux.org/task/20273
-
-Upstream-Status: Pending
-
-Signed-off-by: Li Wang <li.wang@windriver.com>
-Signed-off-by: Maxin B. John <maxin.john@intel.com>
-
----
- etc-rpc      | 2 +-
- etc-services | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/etc-rpc b/etc-rpc
-index 1b30625..9a9a81a 100644
---- a/etc-rpc
-+++ b/etc-rpc
-@@ -1,7 +1,7 @@
- # This file contains user readable names that can be used in place of rpc
- # program numbers.
- 
--portmapper	100000	portmap sunrpc
-+portmapper	100000	portmap sunrpc rpcbind
- rstatd		100001	rstat rstat_svc rup perfmeter
- rusersd		100002	rusers
- nfs		100003	nfsprog
-diff --git a/etc-services b/etc-services
-index fa7ae24..10ba2bc 100644
---- a/etc-services
-+++ b/etc-services
-@@ -51,8 +51,8 @@ kerberos	88/udp		kerberos5 krb5 kerberos-sec	# Kerberos v5
- iso-tsap	102/tcp		tsap		# part of ISODE
- acr-nema	104/tcp		dicom		# Digital Imag. & Comm. 300
- pop3		110/tcp		pop-3		# POP version 3
--sunrpc		111/tcp		portmapper	# RPC 4.0 portmapper
--sunrpc		111/udp		portmapper
-+sunrpc		111/tcp		portmapper rpcbind # RPC 4.0 portmapper
-+sunrpc		111/udp		portmapper rpcbind
- auth		113/tcp		authentication tap ident
- sftp		115/tcp
- nntp		119/tcp		readnews untp	# USENET News Transfer Protocol
diff --git a/meta/recipes-core/netbase/netbase_5.6.bb b/meta/recipes-core/netbase/netbase_5.7.bb
similarity index 69%
rename from meta/recipes-core/netbase/netbase_5.6.bb
rename to meta/recipes-core/netbase/netbase_5.7.bb
index 2aa4971..754c244 100644
--- a/meta/recipes-core/netbase/netbase_5.6.bb
+++ b/meta/recipes-core/netbase/netbase_5.7.bb
@@ -6,11 +6,10 @@ LICENSE = "GPLv2"
 LIC_FILES_CHKSUM = "file://debian/copyright;md5=3dd6192d306f582dee7687da3d8748ab"
 PE = "1"
 
-SRC_URI = "${DEBIAN_MIRROR}/main/n/${BPN}/${BPN}_${PV}.tar.xz \
-           file://netbase-add-rpcbind-as-an-alias-to-sunrpc.patch"
+SRC_URI = "${DEBIAN_MIRROR}/main/n/${BPN}/${BPN}_${PV}.tar.xz"
 
-SRC_URI[md5sum] = "7ad156272c5a42f49c73386ff39c8624"
-SRC_URI[sha256sum] = "5d93a099deb28869b7306e914700fafbd293b55bdb5df05a5aa6effd0af5930c"
+SRC_URI[md5sum] = "f1e50e8d637f6be12af169fa1b67b40a"
+SRC_URI[sha256sum] = "1802ed95847a30d0b618cdfb6fc8f62989fda9fc3d1c0efd0b19e3011a34f915"
 
 UPSTREAM_CHECK_URI = "${DEBIAN_MIRROR}/main/n/netbase/"
 do_install () {
-- 
2.7.4

Re: [PATCH] nss: 3.45 -> 3.47.1

[Richard Purdie]

On Wed, 2019-12-04 at 07:09 -0800, Wang Mingyu wrote:
> Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
> ---
>  meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>  rename meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} (98%)

Fails on beaglebone:

https://autobuilder.yoctoproject.org/typhoon/#/builders/65/builds/1327

Cheers,

Richard

Re: [PATCH] nss: 3.45 -> 3.47.1

[Alexander Kanavin]

[-- Attachment #1: Type: text/plain, Size: 836 bytes --]

On Wed, 4 Dec 2019 at 19:00, Richard Purdie <
richard.purdie@linuxfoundation.org> wrote:

> On Wed, 2019-12-04 at 07:09 -0800, Wang Mingyu wrote:
> > Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
> > ---
> >  meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >  rename meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} (98%)
>
> Fails on beaglebone:
>
> https://autobuilder.yoctoproject.org/typhoon/#/builders/65/builds/1327
>

I had a look into this: the issue is that new versions of nss require
hardware crypto capabilities on ARM (both 32 and 64 bit).
This means we have to disable the recipe when that is not the case; a quick
fix would be:

COMPATIBLE_HOST_armv7a = 'null'

but I would like to hear other ideas too :)

Alex

[-- Attachment #2: Type: text/html, Size: 1720 bytes --]

Re: [PATCH] nss: 3.45 -> 3.47.1

[Andreas Müller]

On Fri, Dec 13, 2019 at 2:22 PM Alexander Kanavin
<alex.kanavin@gmail.com> wrote:
>
> On Wed, 4 Dec 2019 at 19:00, Richard Purdie <richard.purdie@linuxfoundation.org> wrote:
>>
>> On Wed, 2019-12-04 at 07:09 -0800, Wang Mingyu wrote:
>> > Signed-off-by: Wang Mingyu <wangmy@cn.fujitsu.com>
>> > ---
>> >  meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} | 4 ++--
>> >  1 file changed, 2 insertions(+), 2 deletions(-)
>> >  rename meta/recipes-support/nss/{nss_3.45.bb => nss_3.47.1.bb} (98%)
>>
>> Fails on beaglebone:
>>
>> https://autobuilder.yoctoproject.org/typhoon/#/builders/65/builds/1327
>
>
> I had a look into this: the issue is that new versions of nss require hardware crypto capabilities on ARM (both 32 and 64 bit).
Do you have an link for this?
> This means we have to disable the recipe when that is not the case; a quick fix would be:
>
> COMPATIBLE_HOST_armv7a = 'null'
>
> but I would like to hear other ideas too :)
>
I think we should not do that because:

Build log says:
| cc1: error: switch '-mcpu=cortex-a8' conflicts with '-march=armv8-a'
switch [-Werror]
| cc1: all warnings being treated as errors

Nss sets '-march=armv8-a'. Checked in their sources and found that
this is done in lib/freebl source path [1]. With latests sources from
gihub-shadow they introduced 'disable_arm_hw_aes' [1]. Have no idea if
3.47.1 already supports that but we should use it as packageconfig.

I think open questions are still:
* will aarch64 accept their flags?
* isn't something wrong in their logic? They build armv8_c_lib based
on conditions like ''disable_arm_hw_aes==0 and (target_arch=="arm" or
target_arch=="arm64" or target_arch=="aarch64")'' e.g [2] Hmm arm???

[1] https://github.com/nss-dev/nss/blob/4703a817f8b90cc3423620e5c7606bdbcedbcf2e/lib/freebl/freebl.gyp#L170
[2] https://github.com/nss-dev/nss/blob/4703a817f8b90cc3423620e5c7606bdbcedbcf2e/lib/freebl/freebl.gyp#L226

Andreas

Re: [PATCH] nss: 3.45 -> 3.47.1

[Alexander Kanavin]

[-- Attachment #1: Type: text/plain, Size: 1217 bytes --]

On Fri, 13 Dec 2019 at 15:46, Andreas Müller <schnitzeltony@gmail.com>
wrote:

> >> Fails on beaglebone:
> >>
> >> https://autobuilder.yoctoproject.org/typhoon/#/builders/65/builds/1327
> >
> >
> > I had a look into this: the issue is that new versions of nss require
> hardware crypto capabilities on ARM (both 32 and 64 bit).
> Do you have an link for this?
>

Yes. We are using plain Makefiles to build (and not gyp), so the link is:

https://github.com/nss-dev/nss/blob/4703a817f8b90cc3423620e5c7606bdbcedbcf2e/lib/freebl/Makefile#L782


> I think we should not do that because:
>
> Build log says:
> | cc1: error: switch '-mcpu=cortex-a8' conflicts with '-march=armv8-a'
> switch [-Werror]
> | cc1: all warnings being treated as errors
>
> Nss sets '-march=armv8-a'. Checked in their sources and found that
> this is done in lib/freebl source path [1]. With latests sources from
> gihub-shadow they introduced 'disable_arm_hw_aes' [1]. Have no idea if
> 3.47.1 already supports that but we should use it as packageconfig.
>

This option is only available with gyp, and not plain Makefiles
unfortunately. And the way I read it,
it's not actually possible to disable :-/

Alex

[-- Attachment #2: Type: text/html, Size: 2043 bytes --]

Re: [PATCH] nss: 3.45 -> 3.47.1

[Khem Raj]

On Fri, Dec 13, 2019 at 7:21 AM Alexander Kanavin
<alex.kanavin@gmail.com> wrote:
>
> On Fri, 13 Dec 2019 at 15:46, Andreas Müller <schnitzeltony@gmail.com> wrote:
>>
>> >> Fails on beaglebone:
>> >>
>> >> https://autobuilder.yoctoproject.org/typhoon/#/builders/65/builds/1327
>> >
>> >
>> > I had a look into this: the issue is that new versions of nss require hardware crypto capabilities on ARM (both 32 and 64 bit).
>> Do you have an link for this?
>
>
> Yes. We are using plain Makefiles to build (and not gyp), so the link is:
>
> https://github.com/nss-dev/nss/blob/4703a817f8b90cc3423620e5c7606bdbcedbcf2e/lib/freebl/Makefile#L782
>
>>
>> I think we should not do that because:
>>
>> Build log says:
>> | cc1: error: switch '-mcpu=cortex-a8' conflicts with '-march=armv8-a'
>> switch [-Werror]
>> | cc1: all warnings being treated as errors
>>
>> Nss sets '-march=armv8-a'. Checked in their sources and found that
>> this is done in lib/freebl source path [1]. With latests sources from
>> gihub-shadow they introduced 'disable_arm_hw_aes' [1]. Have no idea if
>> 3.47.1 already supports that but we should use it as packageconfig.
>
>
> This option is only available with gyp, and not plain Makefiles unfortunately. And the way I read it,
> it's not actually possible to disable :-/
>

nss is used in quite a few apps, and disabling armv7a is not a good
option, plus hw crypto is only in armv8
thing.

> Alex
> --
> _______________________________________________
> Openembedded-core mailing list
> Openembedded-core@lists.openembedded.org
> http://lists.openembedded.org/mailman/listinfo/openembedded-core

Re: [PATCH] nss: 3.45 -> 3.47.1

[Alexander Kanavin]

[-- Attachment #1: Type: text/plain, Size: 627 bytes --]

On Sat, 14 Dec 2019 at 17:29, Khem Raj <raj.khem@gmail.com> wrote:

> > This option is only available with gyp, and not plain Makefiles
> unfortunately. And the way I read it,
> > it's not actually possible to disable :-/
> >
>
> nss is used in quite a few apps, and disabling armv7a is not a good
> option, plus hw crypto is only in armv8
> thing.
>

I guess I could patch that bit to make it conditional then. It is not
actually mandatory, it's just that they don't have a config switch to
disable it.

In oe-core the only user of nss is rpm, and we're going to switch it over
to openssl or gcrypt.

Alex

[-- Attachment #2: Type: text/html, Size: 985 bytes --]

Re: [PATCH] nss: 3.45 -> 3.47.1

[Andreas Müller]

On Sat, Dec 14, 2019 at 7:28 PM Alexander Kanavin
<alex.kanavin@gmail.com> wrote:
>
> On Sat, 14 Dec 2019 at 17:29, Khem Raj <raj.khem@gmail.com> wrote:
>>
>> > This option is only available with gyp, and not plain Makefiles unfortunately. And the way I read it,
>> > it's not actually possible to disable :-/
>> >
>>
>> nss is used in quite a few apps, and disabling armv7a is not a good
>> option, plus hw crypto is only in armv8
>> thing.
>
>
> I guess I could patch that bit to make it conditional then. It is not actually mandatory, it's just that they don't have a config switch to disable it.
>
> In oe-core the only user of nss is rpm, and we're going to switch it over to openssl or gcrypt.
Grepped around a bit and there are some recipes: most prominent are
firefox / chromium and V8 derived as qtwebengine / some recipes in
meta-netwoerking. / libreoffice

I bet there workarounds for those recipes possible but if Alex can add
some configuration it would save at us trouble/efforts.

Still am not convinced that armv7 was kicked out by intention. Am no
expert but what hardware do moz-people have in mind when writing in
their Makefile:

ifeq ($(CPU_ARCH),arm)
$(OBJDIR)/$(PROG_PREFIX)aes-armv8$(OBJ_SUFFIX): CFLAGS +=
-march=armv8-a -mfpu=crypto-neon-fp-armv8
$(OBJDIR)/$(PROG_PREFIX)gcm-arm32-neon$(OBJ_SUFFIX): CFLAGS += -mfpu=neon
endif

Maybe I should ask ask them...

CU

Andreas