ca_root_nss Root certificate bundle from the Mozilla Project
3.38 security =121

Maintainer: ports-secteam@FreeBSD.org
Port Added: 06 Jul 2007 21:39:01
License: MPL20

Root certificates from certificate authorities included in the Mozilla
NSS library and thus in Firefox and Thunderbird.

This port directly tracks the version of NSS in the security/nss port.

SVNWeb : PortsMon

Pseudo-pkg-plist information, but much better, from make generate-plist
Expand this list (9 items)

1. /usr/local/share/licenses/ca_root_nss-3.38/catalog.mk
2. /usr/local/share/licenses/ca_root_nss-3.38/LICENSE
3. /usr/local/share/licenses/ca_root_nss-3.38/MPL20
4. share/certs/ca-root-nss.crt
5. @sample etc/ssl/cert.pem.sample
6. @sample openssl/cert.pem.sample
7. /etc/ssl/cert.pem
8. @dir /etc/ssl
9. @postexec [ ! -e /usr/local/bin/cert-sync ] || /usr/local/bin/cert-sync --quiet %D/share/certs/ca-root-nss.crt
Collapse this list.

---

To install the port: cd /usr/ports/security/ca_root_nss/ && make install clean
To add the package: pkg install ca_root_nss

PKGNAME: ca_root_nss

distinfo:

TIMESTAMP = 1529573085
SHA256 (nss-3.38.tar.gz) = 2c643d3c08d6935f4d325f40743719b6990aa25a79ec2f8f712c99d086672f62
SIZE (nss-3.38.tar.gz) = 23023474

---

NOTE: FreshPorts displays only information on required and default dependencies. Optional dependencies are not covered.

Build dependencies:

1. perl5>=5.26<5.27 : lang/perl5.26

This port is required by:

for Build

1. devel/librest
2. devel/qca
3. devel/qca-qt5^*
4. net/glib-networking
5. net/s3ql
6. net-im/empathy
7. net-im/telepathy-gabble
Expand this list (14 items)
8. security/gnome-keyring
9. security/gnutls
10. security/mate-keyring^*
11. security/p11-kit
12. sysutils/cinnamon-control-center
13. x11/cinnamon
14. x11/gnome-shell
Collapse this list.

for Fetch

1. print/epson-inkjet-printer-escpr

for Run

1. audio/teamspeak3-server
2. deskutils/google-gadgets^*
3. devel/bazaar-ng^*
4. devel/bzr
5. devel/gitlab-runner
6. devel/librest
7. devel/mercurial
Expand this list (83 items)
8. devel/osc
9. devel/php-composer
10. devel/qca
11. devel/qca-qt5^*
12. devel/stack
13. dns/ddclient
14. dns/dnscrypt-proxy2
15. ftp/curl
16. ftp/curl-hiphop^*
17. graphics/variety
18. irc/hexchat
19. irc/weechat
20. lang/mono
21. mail/courier
22. mail/fetchmail
23. mail/msmtp
24. mail/opensmtpd
25. mail/opensmtpd-devel
26. mail/rspamd
27. mail/sylpheed
28. multimedia/mps-youtube
29. multimedia/plexpy^*
30. multimedia/tautulli
31. net/boinc-client
32. net/bsdec2-image-upload
33. net/glib-networking
34. net/openntpd
35. net/py-matrix-synapse^*
36. net/qt4-network
37. net/qt5-network
38. net/rubygem-grpc
39. net/s3ql
40. net-im/empathy
41. net-im/py-matrix-synapse
42. net-im/telepathy-gabble
43. net-mgmt/netmagis-database
44. net-mgmt/netmagis-www
45. ports-mgmt/freebsd-bugzilla-cli
46. ports-mgmt/poudriere
47. ports-mgmt/poudriere-devel
48. ports-mgmt/redports-node^*
49. security/acme-client
50. security/gnome-keyring
51. security/gnutls
52. security/go-cve-dictionary
53. security/mate-keyring^*
54. security/p11-kit
55. security/pulledpork
56. sysutils/amazon-ssm-agent
57. sysutils/azure-agent
58. sysutils/cbsd
59. sysutils/cinnamon-control-center
60. sysutils/iocage
61. sysutils/osquery
62. sysutils/py-iocage^*
63. sysutils/py3-iocage^*
64. sysutils/ucspi-ssl
65. sysutils/ucspi-ssl-tls^*
66. sysutils/vm-bhyve
67. textproc/py-asciinema
68. textproc/py-sphinx
69. textproc/py3-asciinema^*
70. textproc/py3-sphinx^*
71. www/aria2
72. www/deforaos-surfer
73. www/gist
74. www/mattermost-server
75. www/midori
76. www/miniflux
77. www/neon
78. www/neon29^*
79. www/netsurf
80. www/node8
81. www/py-weboob
82. x11/cinnamon
83. x11/gnome-shell
Collapse this list.

* - deleted ports are only shown under the This port is required by section. It was harder to do for the Required section. Perhaps later...

---

Configuration Options

===> The following configuration options are available for ca_root_nss-3.38:
     ETCSYMLINK=on: Add symlink to /etc/ssl/cert.pem
===> Use 'make config' to modify these settings

---

USES:

perl5 ssl:build

---

Master Sites:

1. https://archive.mozilla.org/pub/security/nss/releases/NSS_3_38_RTM/src/
2. https://download.cdn.mozilla.net/pub/security/nss/releases/NSS_3_38_RTM/src/

security/nss: update to 3.38

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.38_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_38_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/

security/nss: update to 3.37.3

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.37.3_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_37_3_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/

security/nss: update to 3.37.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.37.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_37_1_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/

security/nss: update to 3.37

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.37_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_37_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/

security/nss: update to 3.36.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.36.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_36_1_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/

security/nss: update to 3.36

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.36_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_36_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2018Q1 (required by Firefox 60)

Fix an error reported by pkg when cert-sync doesn't exist.

security/ca_root_nss: Add post-exec script to automatically sync to mono's
certificate store

PR:		225357

security/nss: update to 3.35

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.35_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_35_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2018Q1

security/nss: update to 3.34.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.34.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_34_1_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2017Q4

security/nss: update to 3.34

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.34_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_34_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2017Q4

Update LICENSE

Approved by:	portmgr (blanket)

security/nss: update to 3.32.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.32.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_32_1_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2017Q3 (maybe security, required by firefox-56.0)

security/nss: update to 3.32

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.32_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_32_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2017Q3 (required by firefox-56.0 scheduled on 2017-09-26)

security/nss: update to 3.31

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.31_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_31_RTM
ABI:		https://abi-laboratory.pro/tracker/timeline/nss/
MFH:		2017Q2

security/nss: update to 3.30.2

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30.2_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_2_RTM
MFH:		2017Q2

security/nss: update to 3.30.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_1_RTM
MFH:		2017Q2

security/nss: update to 3.30

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.30_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_30_RTM
MFH:		2017Q1

security/nss: update to 3.29.3

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.2_release_notes
Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.3_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_3_RTM
MFH:		2017Q1

security/nss: update to 3.29.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29.1_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_1_RTM
MFH:		2017Q1

security/nss: update to 3.29

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.29_release_notes
Changes:	https://hg.mozilla.org/projects/nss/shortlog/NSS_3_29_RTM
MFH:		2017Q1

security/nss: update to 3.28.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.28.1_release_notes
MFH:		2017Q1

security/nss: update to 3.28

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.28_release_notes
MFH:		2016Q4

${RM} already has -f.

PR:		213570
Submitted by:	mat
Exp-run by:	antoine
Sponsored by:	Absolight

security/nss: update to 3.27.1 and define license

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.27.1_release_notes
PR:		213312
Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>
MFH:		2016Q4

security/ca_root_nss: adjust pkg-plist to address leftover directory

The port creates /etc/ssl directory with the default option, but until now,
did not remove it upon deinstallation.  While technically this requires
a revbump, rebuilding this port to fix a cleanup step would cause a
tremendous amount of fallout and it's not worth the pain IMO.

PR:		213121
Approved by:	feld (ports-secteam)

security/nss: update to 3.27

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.27_release_notes

This uses OpenSSL, use openssl from ports if available.

Sponsored by:	Absolight

security/nss: update to 3.26

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.26_release_notes
MFH:		2016Q3

When there is a do-install target, do not use a post-install target, do
everything at once.  Sometime, rename post-install into a options helper
target.

I did not fix ports that were such a mess that I could not figure out
what they really wanted to do.  I also did not change ports that had
some version of an auto-plist code in post-install, for the same reason.

With hat:	portmgr
Sponsored by:	Absolight

security/nss: update to 3.25

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.25_release_notes

security/nss: update to 3.22.2

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.22.2_release_notes
Changes:	https://hg.mozilla.org/projects/nss/rev/ec7aee1a4c24
MFH:		2016Q1 (maybe security)

security/nss: update to 3.22

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.22_release_notes
PR:		207030
Submitted by:	Christoph Moench-Tegeder <cmt@burggraben.net>

security/nss: update to 3.21

Temporarily disable gtests as they require C++0x support and install a
library that may have conflicting API with devel/googletest.

Changes:	https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.21_release_notes

- Pass maintainership to ports-secteam, with a explicit approval for gecko@

Differential Revision:	D2640

gecko: catch up with 2015-11-03 release train

- Update NSPR to 4.10.10 [1]
- Update NSS to 3.20.1 [2]
- Update Firefox ESR and libxul to 38.4.0
- Update Firefox to 42.0 [2]
- Update SeaMonkey to 2.39

Changes:	http://mozilla.6506.n7.nabble.com/ANNOUNCE-NSPR-4-10-10-Release-td346822.html
Changes:	https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20.1_release_notes
Changes:	https://www.mozilla.org/en-US/firefox/42.0/releasenotes/
Changes:	http://www.seamonkey-project.org/news#2015-11-08
PR:		204277 [1], 204332 [2], 203099
Submitted by:	swills, Christoph Moench-Tegeder
MFH:		2015Q4
Security:	9d04936c-75f1-4a2c-9ade-4c1708be5df9

security/{,ca_root_}nss: update to 3.20

No CA root changes, just chasing NSS version.

Changes:	https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.20_release_notes

security/{,ca_root_}nss: update to 3.19.3

Changes:	https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19.3_release_notes
MFH:		2015Q3

- Update NSS and ca_root_nss to 3.19.2
- Update Firefox and gmp-api to 39.0
- Update Firefox ESR and libxul to 38.1.0

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19.2_release_notes
Changes:	https://www.mozilla.org/firefox/39.0/releasenotes/
Changes:	https://www.mozilla.org/firefox/38.1.0/releasenotes/
MFH:		2015Q3
Security:	https://vuxml.freebsd.org/freebsd/44d9daee-940c-4179-86bb-6e3ffd617869.html

security/ca_root_nss: Enable certificate verification (for Base OpenSSL)

Enable the ETCSYMLINK option so that SSL certificate verification is
enabled by default for OpenSSL in base.

This change is the third in a set of changes [1][2] that improves the
default configuration and behaviour of client software relying on
OpenSSL for SSL/TLS and certificate verification.

A symlink is installed which points to the root certificate bundle in
the location that OpenSSL in base looks for them, as configured at build
time [2].

This allows any and all software utilising SSL_CTX_load_verify_locations
function to verify SSL certificates by default after installation of
this package.

[1] https://svnweb.freebsd.org/changeset/ports/372629
[2] https://svnweb.freebsd.org/changeset/ports/378720

PR:		189811 196357
Requested by:	many
Submitted by:	dreamcat4 gmail com
Approved by:	maintainer timeout (>1 year)

- Update NSS and ca_root_nss to 3.19.1
- Update Firefox to 38.0.5

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19.1_release_notes
Changes:	https://www.mozilla.org/firefox/38.0.5/releasenotes/
MFH:		2015Q2

Fix spelling of "certification authority"

Approved by:	portmgr (bapt), bapt (ports committer)

- Update NSS and ca_root_nss to 3.19
- Update Firefox to 38.0
- Update Firefox ESR and libxul to 31.7.0
- Update Thunderbird to 31.7.0
- Update Enigmail to 1.8.2

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes
Changes:	https://www.mozilla.org/firefox/38.0/releasenotes/
Changes:	https://www.mozilla.org/firefox/31.7.0/releasenotes/
Changes:	http://sourceforge.net/p/enigmail/bugs/search/?q=status%3Afixed+%26%26+_fixed%3A1.8.1
MFH:		2015Q2
Security:	https://vuxml.freebsd.org/freebsd/d9b43004-f5fd-4807-b1d7-dbf66455b244.html

- Update NSS to 3.18.1

Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.18.1_release_notes
MFH:		2015Q2

- Update OpenH264 to 1.4.0
- Update NSS and ca_root_nss to 3.18
- Update Firefox to 36.0.4
- Update Firefox ESR and libxul to 31.5.3
- Update SeaMonkey to 2.33.1
- Update Enigmail to 1.8

Changes:	https://github.com/cisco/openh264/releases/tag/v1.4.0
Changes:	https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.18_release_notes
Changes:	https://www.mozilla.org/firefox/36.0.4/releasenotes/
Changes:	https://www.mozilla.org/firefox/31.5.3/releasenotes/
Changes:	http://www.seamonkey-project.org/releases/seamonkey2.33/
Changes:	https://www.enigmail.net/download/changelog.php#enig1.8
MFH:		2015Q1
X-MFH-With:	r380090
Security:	https://vuxml.freebsd.org/freebsd/76ff65f4-17ca-4d3f-864a-a3d6026194fb.html

security/ca_root_nss: Fix SSL verification for ports OpenSSL consumers

Since 2.7.9, Python verifies SSL certificates by default. Currently,
even with security/ca_root_nss installed, Python fails certificate
verification.

Upon investigation, Python uses OpenSSL's standard
SSL_CTX_load_verify_locations function to load a list of CA root
certificates.

Support was added to ca_root_nss for "out of the box" certificate
verification for a number of base utilities in r372629 [1], but this
did not include support for software that uses OpenSSL's
SSL_CTX_load_verify_locations function.

- Update NSPR to 4.10.8
- Update NSS to 3.17.2
- Update Firefox to 35.0.1

Changes:	http://mozilla.6506.n7.nabble.com/ANNOUNCE-NSPR-4-10-8-Release-td332365.html
Changes:	https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.17.4_release_notes
Changes:	https://www.mozilla.org/en-US/firefox/35.0.1/releasenotes/
Differential Revision:	https://reviews.freebsd.org/D1736
Approved by:	bapt (mentor)

Remove useless @cwd

- Update Thunderbird to 31.3.0
- Update gmp-api to 35.0
- Update openh264 to 1.2
- Update NSS to 3.17.3
- Update Firefox to 34.0.5
- Update Firefox ESR 31.3.0
- Update libxul to 31.3.0
- Improve CONFIGURE_TARGET handling
- Always build using client.mk
- Switch to clang by default on systems without libc++
  (/stable/8 and /stable/9)
- Drop lang/python2 dependency, only lang/python27 is required
  to build
- Use DuckDuckGo searchplugin from upstream (has suggestions
  and purposes)
- Backport a few about:memory fixes
- Backport Web Notifications libnotify integration
- Add GTK3 option for www/firefox. Adwaita is a bit broken
  since Gtk 3.14, see:
  https://bugzilla.mozilla.org/show_bug.cgi?id=1073117

PR:		195559
Submitted by:	Jan Beich
MFH:		2014Q4
Security:	http://vuxml.org/freebsd/7ae61870-9dd2-4884-a2f2-f19bb5784d09.html

Link in the right place and fix plist

Always install ${PREFIX}/etc/ssl/cert.pem symlink to allow both some base
applications some root certificates.

Discussed with:	des

- Update Firefox to 33.0
- Update Firefox ESR to 31.2.0
- Update NSS to 3.17.2
- Update Thunderbird to 31.2.0
- Update libxul to 31.2.0 (and mark as BROKEN)
- Disable SSL 3.0 with pref (Upstream bug 1076983)
- (workaround) replace USE_GCC=yes with USES=compiler:gcc-c++11-lib in
  order to fix runtime for PGO and powerpc/powerpc64 on libc++ systems
- Add OSS audio fallback for HTML5 audio from upstream bug;
  not exposed yet because WebRTC still needs ALSA or PulseAudio
- Kill @dirrm from gecko@ ports per CHANGES from 20140922
- Drop workaround for LLVM PR 19007: base and lang/clang34 have the fix
- Improve workaround comment for LLVM PR 15840, partially rejecting
  r348851 by marino@ until bug 193555

PR:		194356
Submitted by:	Jan Beich
Security:	http://www.vuxml.org/freebsd/9c1495ac-8d8c-4789-a0f3-8ca6b476619c.html

- Update ca_root_nss to 3.17.1
- Update thunderbird to 31.1.2
- Update seamonkey to 2.29.1
- Update firefox to 32.0.3
- Update firefox-esr to 31.1.1
- Update libxul to 24.8.1

Submitted by:	Jan Beich
Security:	http://www.vuxml.org/freebsd/48108fb0-751c-4cbb-8f33-09239ead4b55.html

Simplify plist (and avoir @cwd)

Mozilla upgrades:
- Update nspr to 4.10.7
- Update ca_root_nss to 3.17 (mark as NO_ARCH while here)
- Update firefox to 32.0
- Update thunderbird to 31.1.0
- Add net-im/linux-instantbird
- Update firefox-est to 31.1.0
- Update libxul to 24.8.0
- Update seamonkey to 2.29

Submitted by:	Jan Beich for gecko@

Update to 3.16.3
Add cpe informations

Submitted by:	Jan Beich

- Update Firefox to 30.0
- Update Firefox ESR to 24.6.0
- Update libxul to 24.6.0
- Update NSS to 3.16.1
- Update NSPR to 4.10.6
- Update Thunderbird to 24.6.0
- Convert USE_BZIP2 to USES
- Backport ff31 fix against crashing DEBUG build on newegg.com [1]
- Add a note in UPDATING to not build audio/soundtouch with
  INTEGER_SAMPLES [2]
- Use arc4random_buf(3) to generate UUIDs (version 4)
- Fix debugger detection used by Telemetry and the slow script dialog
- Add STAGE support [3]

PR:		ports/189991 [1]
PR:		ports/189217 [2]
PR:		ports/189488 [2]
Submitted by:	bapt [3]
Sumbitted by:	Jan Beich
Security:	http://www.vuxml.org/freebsd/888a0262-f0d9-11e3-ba0c-b4b52fce4ce8.html

Convert all :U to :tu and :L to :tl

Since FreeBSD 8.4 and FreeBSD 9.1 make(1) do support :tu and :tl as a
replacement for :U and :L (which has been marked as deprecated)

bmake which is the default on FreeBSD 10+ only support by default
:tu/:tl a hack has been added at the time to support :U and :L to ease
migration. This hack is now not necessary anymore

Note that this makes the ports tree incompatible with make(1) from
FreeBSD 8.3 or earlier

With hat:	portmgr

- Update Firefox to 29.0
- Update Firefox ESR to 24.5.0
- Update Thunderbird to 24.5.0
- Update NSS to 3.16
- Use port dependency for soundtouch library
- Require recent graphite2 version explicitly [1]
- Require gst-libav version that doesn't crash on seeking [2]
  and doesn't error out on plugin load [3]
- Remove gstreamer note in pkg-message for www/firefox, [3] may still
  happen with www/firefox-esr but only until it tracks esr31 (ca 2014-09-01)
- Fix USE_XPI in mail/thunderbird-i18n [4]

Security:	http://www.vuxml.org/freebsd/985d4d6c-cfbd-11e3-a003-b4b52fce4ce8.html
PR:		ports/187939 [1]
PR:		ports/188133 [2]
PR:		ports/181964 [3]
PR:		ports/188984 [4]
Submitted by:	Toomas Aas <toomas.aas@raad.tartu.ee> [1]
Submitted by:	Jakub Lach <jakub_lach@mailplus.pl> [2]
Submitted by:	Jan Beich [3] and this update!
Submitted by:	Toni Ballesta <mustelator@yahoo.es> [4]
Approved by:	portmgr (bdrewery, security update to non-staged port)

- Update Firefox to 28.0
- Update Firefox ESR to 24.4.0
- Update Thunderbird to 24.4.0
- Update NSPR to 4.10.4
- Update NSS to 3.15.5
- Switch GSTREAMER option for non-esr ports to depend on
  multimedia/gstreamer1 [2]
- Switch to Uses/compiler.mk, defaults to lang/gcc47 on 8.x and 9.x
- Use port dependencies for libogg, libvorbis, libopus, harfbuzz, graphite2
- Enable readahead in url-classifier, asmjs, download resume like on Linux
- Build www/firefox and www/seamonkey faster using unified compilation
- Unbreak build on sparc64 [1]
- Workaround OPTIMIZED_CFLAGS startup crash on 8.x and 9.x
- OPTIMIZED_CFLAGS is enabled by default
- A few DEBUG build fixes
- Add clang 3.2/3.3/3.4 workarounds for i386
- Mention known GSTREAMER issue in pkg-message

Submitted by:	Jan Beich
PR:		ports/186580 [1]
Requested by:	kwm [2]
Security:	http://www.vuxml.org/freebsd/610de647-af8d-11e3-a25b-b4b52fce4ce8.html

- Update Firefox to 27.0
- Update Firefox ESR to 24.3.0
- Update Thunderbird to 24.3.0
- Update NSPR to 4.10.3
- Update NSS to 3.15.4
- Depend on yasm when building with bundled libvpx or libjpeg-turbo
- Prepare gstreamer conditional for upcoming Firefox versions
- Improve jemalloc3 conditional
- Break build unless alsa-lib port installs new config file
- Chase USE_DOS2UNIX deprecation
- Temporarily disable system cairo over screen corruption with
  smoothScroll [1]

Submitted by:	Jan Beich
Reported by:	flo [1]
Security:	http://www.vuxml.org/freebsd/1753f0ff-8dd5-11e3-9b45-b4b52fce4ce8.html

Update to nspr 4.10.2
Update to nss 3.15.3.1
Update firefox-esr and thunderbird to 24.2.0
Update firefox to 26.0
Update seamonkey to 2.23

- catch up with directory renames since USES=webplugins was introduced;
  fixes plugins not being automatically enabled after install
- linux-firefox and linux-seamonkey can play HTML5 audio [2][3] and
  measure about:memory usage, again
- dom.ipc.plugins.enabled->true no longer crash linux-firefox which makes
  some flash sites work again; as there's no nspluginwrapper in-between
  the infamous "youtube issue" never occurs
- install DEBUG with symbols [3] and describe the option better [4]
- enable dumping about:memory upon kill -65, kill -66 and GC/CC log
  upon kill -67 to a file under /tmp directory; linux-firefox uses
  kill -34, kill -35 and kill -36 respectively

PR:		ports/183861 [1]
PR:		ports/184006 [2]
PR:		ports/169896 [3]
PR:		ports/184285 [3]
PR:		ports/184286 [4]
Security:	dd116b19-64b3-11e3-868f-0025905a4771
In collaboration with: Jan Beich <jbeich@tormail.org>

- fix stage conversion in the ETCSYMLINK case
- move the check to post-install

Reported by:	ak

- update to 3.15.2 [1]
- support stage

PR:		ports/183282 [1]
Submitted by:	pfg [1]

Add NO_STAGE all over the place in preparation for the staging support (cat:
security)

Convert to new perl framework
Convert USE_GMAKE to USES=gmake

Update extraction script to:

- Only look at CKA_TRUST_SERVER_AUTH, _EMAIL_PROTECTION, and
  _CODE_SIGNING attributes.

- Omit certificates that do not have any explicit trust value in these
  three attributes; at least one of the purposes must mark the
  certificate a trusted delegator.

- Validate that the trust is one of three known trust values, to become
  aware of syntax changes in certdata.txt. If it is an unknown token,
  abort with an error stating that the script must be updated.

- Check that we have at least 25 certificates in the output or abort.

Update to 3.15.1

Submitted by:	Jan Beich <jbeich@tormail.org>

- update firefox to 21.0
- update firefox-esr and thunderbird to 17.0.6
- WEBRTC now supports PULSEAUDIO
- make linux-firefox work with plugins again (e.g. quakelive)

Security:		4a1ca8a4-bd82-11e2-b7a0-d43d7e0c7c02
In collaboration with:	Jan Beich <jbeich@tormail.org>

Support WITH_DEBUG=yes to get more debug output from the bundle
creation, to verbosely print omitted and included certificates.

Approved by:	flo@ on "as long as you fix it if it breaks" condition

- update firefox to 19.0
- update firefox-esr, thunderbird, linux-firefox, linux-thunderbird to 17.0.3
- update linux-seamonkey to 2.16
- update nspr to 4.9.5
- update nss to 3.14.3
- add DuckDuckGo search plugin to firefox [1]
- mark kompozer deprecated
- clang fixes for www/libxul19 [2]

Security:	http://www.vuxml.org/freebsd/e3f0374a-7ad6-11e2-84cd-d43d7e0c7c02.html
Submitted by:	DuckDuckGo [1], dim [2]
In collaboration with:	Jan Beich <jbeich@tormail.org>

- update firefox, thunderbird, linux-firefox and linux-thunderbird to 17.0.2
- update firefox-esr, thunderbird-esr and libxul to 10.0.12
- update linux-seamonkey to 2.15

Security:	http://www.vuxml.org/freebsd/a4ed6632-5aa9-11e2-8fcb-c8600054b392.html

Update to 3.14.1.with.ckbi.1.93

This was released to revoke certificates that were used for MITM. For
details see:

https://blog.mozilla.org/security/2013/01/03/revoking-trust-in-two-turktrust-certficates/

- Update www/firefox{,-i18n} to 16.0.2
- Update seamonkey to 2.13.2
- Update ESR ports and libxul to 10.0.10
- Update nspr to 4.9.3
- Update nss to 3.14
- with GNOMEVFS2 option build its extension, too [1]
- make heap-committed and heap-dirty reporters work in about:memory
- properly mark QT4 as experimental (needs love upstream)
- *miscellaneous cleanups and fixups*

mail/thunderbird will be updated once the tarballs are available.

PR:		ports/173052 [1]
Security:	6b3b1b97-207c-11e2-a03f-c8600054b392
Feature safe:	yes
In collaboration with:	Jan Beich <jbeich@tormail.org>

- Update firefox-esr, thunderbird-esr, linux-firefox and linux-thunderbird to
10.0.8
- Update firefox and thunderbird to 16.0
- Update seamonkey to 2.13
- Update all -i18n ports respectively
- switch firefox 16.0 and seamonkey 2.13 to ALSA by default for better
  latency during pause and seeking with HTML5 video
- remove fedisableexcept() hacks, obsolete since FreeBSD 4.0
- support system hunspell dictionaries [1]
- unbreak -esr ports with clang3.2 [2]
- unbreak nss build when CC contains full path [3]
- remove GNOME option grouping [4]
- integrate enigmail into thunderbird/seamonkey as an option [5]
- remove mail/enigmail* [6]
- enable ENIGMAIL, LIGHTNING and GIO options by default
- add more reporters in about:memory: page-faults-hard, page-faults-soft,

- Update to 3.13.5
- Convert to optionsng

update to 3.13.4

Update to 3.13.3

Just overwrite the link if it still exists. That way we are sure that the link
points to the correct file and there is no reason trying to protect the link as
it would be deleted on deinstall anyway.

Suggested by:   dougb

make sure installation does not fail if for whatever reason the symlink in
/etc/ssl is still there on (re)install phase with ETCSYMLINK option set.

Submitted by:   mi

update to 3.13.2

- update to NSS_3_13_1_WITH_CKBI_1_88_RTM

update to CKBI version 1.88 which includes the latest mozilla cert data

now that gecko maintains security/nss also take this port into gecko custody

Discussed with: brooks @ EuroBSDCon 2011
Approved by:    brooks

Change extract program:
- Also work with HEAD (1.79) version of Mozilla's certdata.txt,
  reported by Daniel Stenberg.
- Add BSD 2-clause license.
- Die when certificates without trust block appear.

Forced commit to note:
VID: aa5bc971-d635-11e0-b3cf-080027ef73ec
VID: 1b27af46-d6f6-11e0-89a6-080027ef73ec

See to proper version tags in the bundle .pem file.

Security update: use newer Mozilla Builtin-Trust store
to revoke DigiNotar.nl trust.

Security fix: the modssl ca-bundle.pl script did not process
"untrusted" marks on certificates. Drop it and write a new
script in its place that does that.

Synch up with security/nss port to 3.12.11.

Not asking for maintainer approval because of multiple
timeouts in response to related PRs vs. security/[ca_root_]nss.

Increase the size and verbosity of the comment that the versions used in
this port should track security/nss and www/apache13-modssl.

No functional impact.

Chase nss revision and update to 3.12.9.

PR:             ports/154961
Submitted by:   Niclas Zeising

- fix file name ca-bundle.crt -> ca-root-nss.crt [1]
- Properly sub VERSION_NSS var [1]
- While here, update to 3.12.6 to sync with security/nss

PR:             ports/143584 [1]
Submitted by:   Kevin Kobb <kkobb@skylinecorp.com> [1]
Approved by:    maintainer timeout (brooks ; 209 days) [1]

Upgrade to 3.12.4.

PR:             ports/140609
Submitted by:   Tijl Coosemans <tijl at ulyssis dot org>

Add a comment documenting the fact that we track the versions of
security/nss and www/apach13-modssl.

PR:             ports/136093

o Fix port OPTION ETCSYMLINK which was not creating the proper link.
  Instead of pointing to the crt file, it was pointing to the directory.
o Bump PORTREVISION

PR:             ports/121782
Submitted by:   lioux
Point hat to:   brooks

Add an option (defaulting to off since messing with files outside PREFIX is
to be avoided) to link the installed certificate bundle to /etc/ssh/cert.pem

Add text to pkg-descr:

This port directly tracks the version of NSS in the security/nss port.

Chase nss version to 3.11.9 and modssl to 2.8.31-1.3.41.  This
includes the changes:

Bug 411299, Add Identrust, Truktrust, SwissSign Roots
Bug 229335, Remove certificates that expired in August 2004 from tree

Update to NSS 3.11.7 to match security/nss.

8 new root certiticates added.

Add ca_root_nss:

Root certificates from certificate authorities included in the Mozilla
NSS library and thus in Firefox and Thunderbird.

14 vulnerabilities affecting 116 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities

Last updated:
2018-06-16 15:43:50