Upgrade bundled NSS to 3.112.5 (with NSPR 4.38.2)

Bump the bundled NSS/NSPR from 3.39/4.20 (2018) to the current NSS ESR
release 3.112.5 with NSPR 4.38.2, and re-work the AOO patch set for the
new sources. Verified by a full clean arm64 macOS build (dmake unpack ->
patch -> compile -> deliver, exit 0): all 12 libraries build as native
arm64 (libnss3, libnspr4, libfreebl3, libsmime3, libssl3, libsoftokn3,
libnssutil3, libnssdbm3, libplc4, libplds4, and the nssckbi pair).

Patch changes:
- Delete nss_sizes.patch: its CVE-2021-43527 signature-length hardening
  (checkedSignatureLen) is already upstream in 3.112.5.
- nss.patch: drop the obsolete zlib/inflate.c hunk (upstream already
  rewrote the signed-shift UB), and fix an infinite make recursion in
  cmd/shlibsign. AOO comments out CHECKLIBS to disable FIPS .chk signing,
  which leaves CHECKLOC empty-but-defined, so "ifdef CHECKLOC" stayed true
  and ran a bare $(MAKE) that re-entered the default target forever once
  3.112 added "DIRS = mangle" to shlibsign. Guard on non-empty instead:
  ifneq ($(strip $(CHECKLOC)),).
- nss_macosx.patch: drop the NSPR configure arm64 hunk (3.112.5 NSPR maps
  aarch64 -> "-arch arm64" natively) and the sqlite config.mk hunk (only
  relevant pre-10.5; the deployment-target rewrite would wrongly define
  SQLITE_WITHOUT_ZONEMALLOC at the 11.0 baseline). Keep the Darwin.mk
  "override CPU_ARCH = aarch64" -- still required because uname -p reports
  "arm" on Apple Silicon and freebl selects 64-bit HACL only for aarch64.
- nss_linux.patch / nss_freebsd.patch: re-path to nss-3.112.5 only.

Windows patches (nss_win.patch, nss.patch.mingw) are left in place with
FIXME notes: nss_win.patch is old-MSVC (<VS2010) shims that no longer
apply to the rewritten freebl HACL sources, and nss.patch.mingw targets
the ancient nss-3.13.6 mozilla/security layout. Both need regenerating on
a Windows host and were not validated here.

Only the macOS/arm64 path was built and verified; Linux/FreeBSD patches
apply cleanly but were not built, and xmlsecurity (the sole consumer) was
not rebuilt against the new headers.
7 files changed
tree: f113f118e53232d02ca47ef9656c8baf73f3e0bb
  1. .github/
  2. ext_libraries/
  3. ext_sources/
  4. extras/
  5. main/
  6. test/
  7. .asf.yaml
  8. .gitignore
  9. .pre-commit-config.yaml
  10. AOO-trunk.md
  11. LICENSE
  12. Makefile
  13. README.md
  14. requirements-dev.txt
README.md

Apache OpenOffice®

The Apache OpenOffice project (AOO) provides a full featured office productivity suite based on open standards. It is the continuation of the OpenOffice.org project.

For detailed information about Apache OpenOffice please visit the Project Website.

Apache OpenOffice is a very large project with many components and mainly implemented in C++ but also in Java, Perl, Python and other languages.

Currently supported platforms include:

  • Microsoft Windows
  • macOS (OS X)
  • Linux variants
  • FreeBSD
  • OS/2

OpenOffice is used by millions of users worldwide and with more than 398 million downloads it is one of the most successful open source projects.

Getting the latest sources via Git

You can always checkout the latest source via Git using the following command:

git clone https://gitbox.apache.org/repos/asf/openoffice.git aoo

For further information visit https://openoffice.apache.org/source.html.

Building Apache OpenOffice

Apache OpenOffice is a big project and depends on several other external libraries.
The list of prerequisites varies for the different platforms.

A comprehensive and complete building guide can be found in the Project Wiki.

With having all prerequisites in place you can simply run

cd aoo/main
autoconf
./configure <configure_switches>
./bootstrap
source *.Set.sh
cd instsetoo_native
build --all

Note that building OpenOffice can take several hours.

The default build will produce a setup version (e.g. setup program on Windows, dmg on macOS, rpm and deb packages on Linux) and an archived version.
The output can be found in the directory in instsetoo_native/<output_dir>/Apache_OpenOffice/...