618368 - Mozilla upgrade to NSS 3.12.9 final

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

NSS 3.12.9 beta already landed; see bug 599324.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Nominating to be blocking 2.0 final; see bug 599324 comment 29.

Comment 2

[Landry Breuil (:gaston)]

As of 4.0b8, if one wants to build against systemwide nss/nspr, it needs 3.12.9 / nspr 4.8.7, and those are not released/available on mirrors..
Can we have an ETA for this releases ?

Comment 3

[Kai Engert (:KaiE:)]

Landry, sorry, we haven't prepared tarballs yet, we usually don't do that for beta versions.

Could you please fetch beta versions yourself from CVS?

:pserver:[e-mail]:/cvsroot

cvs co -r NSPR_4_8_7_BETA2 mozilla/nsprpub
cvs co -r NSS_3_12_9_BETA2 mozilla/security/nss mozilla/security/coreconf \
                           mozilla/dbm mozilla/security dbm

If you don't want to pull from cvs, we plan the final release and tarballs to be available by end of first week in January.

Comment 4

[Landry Breuil (:gaston)]

Oh, okay. As the dependencies in configure.in were bumped to 4.8.7/3.12.9,
i thought those had been actually released. My mistake.
I'll wait for the final releases tarballs then, and stay with 4.0b7 in the meantime.

Comment 5

[Kai Engert (:KaiE:)]

The releases are tagged and tarballs uploaded.
ftp://ftp.mozilla.org/pub/mozilla.org/nspr/releases/v4.8.7/src/
ftp://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_12_9_RTM/src/

Comment 6

[Landry Breuil (:gaston)]

Thanks for the notice, both versions build fine on OpenBSD -current.

Comment 7

[Kai Engert (:KaiE:)]

pushed to mozilla-central.

http://hg.mozilla.org/mozilla-central/rev/17fae822d2d7

Comment 8

[Kai Engert (:KaiE:)]

Let's decide, should this be given to FF 3.6 and FF 3.5 stable branches?

Comment 9

[Wan-Teh Chang]

Yes, I recommend that.

Comment 10

[Kai Engert (:KaiE:)]

Requesting approval for stable branches.

Comment 11

[Kai Engert (:KaiE:)]

I didn't notice the branch approval until now.

The upgrade to NSS 3.12.9 implies the NSPR upgrade to 4.8.7

Comment 12

[Kai Engert (:KaiE:)]

Upgraded to 4.8.7 and 3.12.9 on both branches.

I reapplied the lower-dhe-priority patch
(luckily we have the security/patches directory)

I didn't see a nsprpub/patches directory, and couldn't find anything in the log,
I conclude no patches on top of NSPR are currently being used on the branches.

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/62bf42e973e9
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/753d58ad2332

Comment 13

[Daniel Veditz [:dveditz]]

The "3.6.15" we're releasing today does not fix this bug, the release containing this bug fix has been renamed to "3.6.16" and the bugzilla flags will be updated to reflect that soon. Today's release is a re-release of 3.6.14 plus a fix for a bug that prevented many Java applets from starting up.

Comment 14

[Huzaifa Sidhpurwala]

Does it make sense to fix https://bugzilla.mozilla.org/show_bug.cgi?id=646460 , before we upgrade nss?