2089407 - Update NSS to new version a51dafa783e59656d1729e2b4dacc08b7a8a52b2 from 2026-11-04 21:55:27 UTC

Status: RESOLVED DUPLICATE of bug 2090046

(Core :: Security: PSM, enhancement)

Description

[Update Bot]

This update covers 7 commits. Here are the overall diff statistics, and then the commit information.

---

security/nss/automation/abi-check/previous-nss-release | 2 +-
security/nss/cmd/platlibs.mk | 2 +
security/nss/coreconf/fuzz.sh | 2 +-
security/nss/gtests/mozpkix_gtest/mozpkix_gtest.gyp | 7 +-
security/nss/gtests/mozpkix_gtest/pkixcert_extension_tests.cpp | 31 +++
security/nss/gtests/ssl_gtest/manifest.mn | 1 +
security/nss/gtests/ssl_gtest/ssl_gtest.gyp | 1 +
security/nss/gtests/ssl_gtest/ssl_peer_cert_unittest.cc | 101 ++++++++++
security/nss/gtests/ssl_gtest/tls_agent.cc | 2 +
security/nss/gtests/ssl_gtest/tls_agent.h | 2 +
security/nss/lib/Makefile | 4 +-
security/nss/lib/mozpkix/Makefile | 67 ++++++
security/nss/lib/mozpkix/include/pkix/pkixutil.h | 5 +
security/nss/lib/mozpkix/lib/Makefile | 47 ++++
security/nss/lib/mozpkix/lib/manifest.mn | 26 ++
security/nss/lib/mozpkix/lib/pkixcert.cpp | 17 +-
security/nss/lib/mozpkix/manifest.mn | 9 +
security/nss/lib/mozpkix/mozpkix.gyp | 55 +++++
security/nss/lib/mozpkix/mozpkix_cxx.gypi | 27 ++
security/nss/lib/mozpkix/mozpkix_cxx.mk | 20 +
security/nss/lib/nss/nss.h | 6 +-
security/nss/lib/softoken/softkver.h | 6 +-
security/nss/lib/ssl/Makefile | 2 +
security/nss/lib/ssl/config.mk | 4 +
security/nss/lib/ssl/manifest.mn | 4 +
security/nss/lib/ssl/mozpkixwrappers.cpp | 47 ++++
security/nss/lib/ssl/ssl.gyp | 6 +
security/nss/lib/ssl/sslcert.c | 72 -------
security/nss/lib/ssl/sslimpl.h | 5 +-
security/nss/lib/util/nssutil.h | 6 +-
security/nss/moz.yaml | 4 +-
security/nss/tests/common/certsetup.sh | 10 +
security/nss/tests/ssl_gtests/ssl_gtest_db.sh | 2 +
33 files changed, 509 insertions(+), 93 deletions(-)

---

a51dafa783e59656d1729e2b4dacc08b7a8a52b2 by Goutam Tamvada <[e-mail]>

https://github.com/mozilla/nss/commit/a51dafa783e59656d1729e2b4dacc08b7a8a52b2
Authored: 2026-11-04 21:55:27 +0000
Committed: 2026-11-04 21:55:27 +0000

Bug 2083934 - Use mozpkix to extract the peer certificate's subjectPublicKeyInfo in libssl. r=jschanck,nss-reviewers

Differential Revision: https://phabricator.services.mozilla.com/D336284

--HG--
rename : lib/ssl/Makefile => lib/mozpkix/Makefile
rename : lib/ssl/Makefile => lib/mozpkix/lib/Makefile

Files Added:

• gtests/ssl_gtest/ssl_peer_cert_unittest.cc
• lib/mozpkix/Makefile
• lib/mozpkix/lib/Makefile
• lib/mozpkix/lib/manifest.mn
• lib/mozpkix/manifest.mn
• lib/mozpkix/mozpkix_cxx.gypi
• lib/mozpkix/mozpkix_cxx.mk
• lib/ssl/mozpkixwrappers.cpp

Files Modified:

• cmd/platlibs.mk
• gtests/mozpkix_gtest/mozpkix_gtest.gyp
• gtests/ssl_gtest/manifest.mn
• gtests/ssl_gtest/ssl_gtest.gyp
• gtests/ssl_gtest/tls_agent.cc
• gtests/ssl_gtest/tls_agent.h
• lib/Makefile
• lib/mozpkix/mozpkix.gyp
• lib/ssl/Makefile
• lib/ssl/config.mk
• lib/ssl/manifest.mn
• lib/ssl/ssl.gyp
• lib/ssl/sslcert.c
• lib/ssl/sslimpl.h
• tests/common/certsetup.sh
• tests/ssl_gtests/ssl_gtest_db.sh

---

6073fd8a0a0b55f95337f7d18a5323f1966ae199 by Goutam Tamvada <[e-mail]>

https://github.com/mozilla/nss/commit/6073fd8a0a0b55f95337f7d18a5323f1966ae199
Authored: 2026-11-04 21:55:27 +0000
Committed: 2026-11-04 21:55:27 +0000

Bug 2083934 - Add helper to mozpkix to extract subjectPublicKeyInfo. r=jschanck,nss-reviewers

Differential Revision: https://phabricator.services.mozilla.com/D336283

Files Modified:

• gtests/mozpkix_gtest/pkixcert_extension_tests.cpp
• lib/mozpkix/include/pkix/pkixutil.h
• lib/mozpkix/lib/pkixcert.cpp

---

2e636d07afa25f58502523caab0e2b0e9bd4e06c by John Schanck <[e-mail]>

https://github.com/mozilla/nss/commit/2e636d07afa25f58502523caab0e2b0e9bd4e06c
Authored: 2026-11-04 16:54:38 +0000
Committed: 2026-11-04 16:54:38 +0000

Bug 1989541 - Don't disable CK_PKCS5_PBKD2_PARAMS support in fuzzing builds. r=nss-reviewers,aweine

Differential Revision: https://phabricator.services.mozilla.com/D339258

Files Modified:

• coreconf/fuzz.sh

---

33880ee5ee4bb6a481af885b63bbdd16e18f4576 by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/33880ee5ee4bb6a481af885b63bbdd16e18f4576
Authored: 2026-11-04 17:03:09 +0100
Committed: 2026-11-04 17:03:09 +0100

Backed out changeset a0d3c7158f02 (Bug 2088965) for landing without review.

Files Modified:

• gtests/pk11_gtest/pk11_prf_unittest.cc

---

d085603d568ceeab350fda6174254a52284a24d9 by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/d085603d568ceeab350fda6174254a52284a24d9
Authored: 2026-11-04 16:58:00 +0100
Committed: 2026-11-04 16:58:00 +0100

Set version numbers to 3.134 Beta

Files Modified:

• automation/abi-check/previous-nss-release
• lib/nss/nss.h
• lib/softoken/softkver.h
• lib/util/nssutil.h

---

05d82a865783f2747c9b23f6fc4b4601e73dfcef by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/05d82a865783f2747c9b23f6fc4b4601e73dfcef
Authored: 2026-11-04 16:57:58 +0100
Committed: 2026-11-04 16:57:58 +0100

Release notes for NSS 3.133

--HG--
extra : source : 96d446dc5bd8b606c0f14ce6490ee403d37cdb2f

Files Added:

• doc/src/releases/nss_3_133.md

Files Modified:

• doc/src/releases/index.md

---

6a13e63a81655f44473eb35e8a4c7f27d024cb9f by Anna Weine <[e-mail]>

https://github.com/mozilla/nss/commit/6a13e63a81655f44473eb35e8a4c7f27d024cb9f
Authored: 2026-11-04 16:39:13 +0100
Committed: 2026-11-04 16:39:13 +0100

Bug 2088965 - [Coverity 1704719] Reset freed keys in TlsPrfTest::ClearTempVars

Differential Revision: https://phabricator.services.mozilla.com/D339540

--HG--
extra : amend_source : e4bf90c54bced7c9d19139cee74b7d5595c0021d

Files Modified:

• gtests/pk11_gtest/pk11_prf_unittest.cc

---

Comment 1

[Update Bot]

I've submitted a try run for this commit: https://treeherder.mozilla.org/jobs?repo=try&revision=a5422e72c1b26c388bb5d2e88668347aac490839

Comment 2

[Update Bot]

Attachment: Bug 2089407 - Update NSS to a51dafa783e59656d1729e2b4dacc08b7a8a52b2

Comment 3

[Update Bot]

The try push is done, we found jobs with unclassified failures.

Needs Close Investigation:

• security/manager/ssl/tests/unit/test_cert_overrides.js
  • 26 of 26 failed on different tasks
    - test-windows10-64-2009-qr/opt-xpcshell (OoylRTu6R_qxTZvMO2w5UA)
    - test-macosx1500-aarch64/opt-xpcshell (NkbaQ4qfQzi5JEOk9Ug-ug)
    - test-android-em-14-x86_64/opt-geckoview-xpcshell (bKdFtZ5NRNOl2GijvwHIXQ)
    - test-linux2404-64-tsan/opt-xpcshell-nofis (CQba0dXkQIG4740wxbWjgg)
    - test-linux2404-64/debug-xpcshell (AhynPeBbSieEHYcmwlIULg)
    - test-linux2404-64-asan/opt-xpcshell (IO-NTKdMRe2M0jj8WopbbQ)
    - test-macosx1500-aarch64/debug-xpcshell (X1dZNRvfS6SqsH4BUKR_vA)
    - test-android-em-14-x86_64/opt-geckoview-xpcshell-nofis (V-SqiN-zTcm-Gy4qArlIxQ)
    - test-linux2404-64/debug-xpcshell-nofis (bUcs1VVDQyKQg-u4S0TCeg)
    - test-macosx1500-aarch64-vms/debug-xpcshell (UZsAOgq8TtegUjEzofx15g)
    - test-linux2404-64/opt-xpcshell (DPNP2ddZSIyfNeWyiQVI0A)
    - test-linux2404-64-tsan/opt-xpcshell (fcOoSVc4T8e6NJfR3lM_Ig)
    - test-android-em-14-x86_64/debug-geckoview-xpcshell (Zn5umiQ5RP6FIttRWLh7ug)
    - test-linux2404-64-asan/opt-xpcshell-nofis (NVSnfV93Q3i3j2g5qs2mSw)
    - test-android-em-14-x86_64-lite/opt-geckoview-xpcshell-nofis (GPHVq-RCQlGpuEyJNuRuTg)
    - test-windows11-64-25h2/opt-xpcshell (bOEwiuo0RO2ZUkOpLtTBng)
    - test-windows10-64-2009-qr/debug-xpcshell (SMZEtTqkTNu5C2yQJnoNQQ)
    - test-windows11-64-25h2/debug-xpcshell (TVDICM1XT4mMBH8Wk7HBPw)
    - test-macosx1015-64-qr/debug-xpcshell (T_zhQ2ZeQD25PDoEBU3Eew)
    - test-windows11-32-25h2/opt-xpcshell (PLYuiUOATnmYopUNNeHlyg)
    - test-macosx1500-aarch64-vms/opt-xpcshell (TY8iYFhST9qlC7cIJ4kQUA)
    - test-android-em-14-x86_64/debug-geckoview-xpcshell-isolated (aqc2m4W6QuiPRRcuHDINSw)
    - test-android-em-14-x86_64-lite/opt-geckoview-xpcshell (IK_N66yRQ9WIS0RdHZb12g)
    - test-windows11-32-25h2/debug-xpcshell (YxN8s2g1RXy83BCeW-uWDg)
    - test-macosx1015-64-qr/opt-xpcshell (GSdgNGXFSdWyRlrFRFX9Jw)
    - test-android-em-14-x86_64/debug-geckoview-xpcshell-nofis (INx4SiZTTzWPh2ByGzyUZw)

These failures could mean that the library update changed something and caused
tests to fail. You'll need to review them yourself and decide where to go from here.

In either event, I have done all I can and you will need to take it from here. If you
don't want to land my patch, you can replicate it locally for editing with
./mach vendor security/nss/moz.yaml

When reviewing, please note that this is external code, which needs a full and
careful inspection - not a rubberstamp.

Comment 4

[Update Bot]

This bug is being closed because a newer revision of the library is available.
This bug will be marked as a duplicate of it (because although this bug is older, it is superseded by the newer one).