)]}'
{
  "commit": "6e210416e5a4104b533cffe88da81529270e7cf5",
  "tree": "f113f118e53232d02ca47ef9656c8baf73f3e0bb",
  "parents": [
    "2e60be5056c0019c45ae9173c95568a54145a76b"
  ],
  "author": {
    "name": "Jim Jagielski",
    "email": "jimjag@gmail.com",
    "time": "Wed Jul 01 09:49:01 2026 -0400"
  },
  "committer": {
    "name": "Jim Jagielski",
    "email": "jimjag@gmail.com",
    "time": "Wed Jul 01 09:49:01 2026 -0400"
  },
  "message": "Upgrade bundled NSS to 3.112.5 (with NSPR 4.38.2)\n\nBump the bundled NSS/NSPR from 3.39/4.20 (2018) to the current NSS ESR\nrelease 3.112.5 with NSPR 4.38.2, and re-work the AOO patch set for the\nnew sources. Verified by a full clean arm64 macOS build (dmake unpack -\u003e\npatch -\u003e compile -\u003e deliver, exit 0): all 12 libraries build as native\narm64 (libnss3, libnspr4, libfreebl3, libsmime3, libssl3, libsoftokn3,\nlibnssutil3, libnssdbm3, libplc4, libplds4, and the nssckbi pair).\n\nPatch changes:\n- Delete nss_sizes.patch: its CVE-2021-43527 signature-length hardening\n  (checkedSignatureLen) is already upstream in 3.112.5.\n- nss.patch: drop the obsolete zlib/inflate.c hunk (upstream already\n  rewrote the signed-shift UB), and fix an infinite make recursion in\n  cmd/shlibsign. AOO comments out CHECKLIBS to disable FIPS .chk signing,\n  which leaves CHECKLOC empty-but-defined, so \"ifdef CHECKLOC\" stayed true\n  and ran a bare $(MAKE) that re-entered the default target forever once\n  3.112 added \"DIRS \u003d mangle\" to shlibsign. Guard on non-empty instead:\n  ifneq ($(strip $(CHECKLOC)),).\n- nss_macosx.patch: drop the NSPR configure arm64 hunk (3.112.5 NSPR maps\n  aarch64 -\u003e \"-arch arm64\" natively) and the sqlite config.mk hunk (only\n  relevant pre-10.5; the deployment-target rewrite would wrongly define\n  SQLITE_WITHOUT_ZONEMALLOC at the 11.0 baseline). Keep the Darwin.mk\n  \"override CPU_ARCH \u003d aarch64\" -- still required because uname -p reports\n  \"arm\" on Apple Silicon and freebl selects 64-bit HACL only for aarch64.\n- nss_linux.patch / nss_freebsd.patch: re-path to nss-3.112.5 only.\n\nWindows patches (nss_win.patch, nss.patch.mingw) are left in place with\nFIXME notes: nss_win.patch is old-MSVC (\u003cVS2010) shims that no longer\napply to the rewritten freebl HACL sources, and nss.patch.mingw targets\nthe ancient nss-3.13.6 mozilla/security layout. Both need regenerating on\na Windows host and were not validated here.\n\nOnly the macOS/arm64 path was built and verified; Linux/FreeBSD patches\napply cleanly but were not built, and xmlsecurity (the sole consumer) was\nnot rebuilt against the new headers.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "07a35373ca51a2e0520e07729cefdd5546c3ccc5",
      "old_mode": 33188,
      "old_path": "main/external_deps.lst",
      "new_id": "ae4e4f92f428cedd5417ff178c8d21a78a0814c1",
      "new_mode": 33188,
      "new_path": "main/external_deps.lst"
    },
    {
      "type": "modify",
      "old_id": "106143e7fe28fa0eadd7955f12573d83eeb66361",
      "old_mode": 33188,
      "old_path": "main/nss/makefile.mk",
      "new_id": "a85329f1626752243b547c327899dd3ac686aa18",
      "new_mode": 33188,
      "new_path": "main/nss/makefile.mk"
    },
    {
      "type": "modify",
      "old_id": "18016e4c0e27fa502cfcdd431acfc02b11d3630b",
      "old_mode": 33188,
      "old_path": "main/nss/nss.patch",
      "new_id": "cfd2fb1e44282f5b9276841a4c784de34ce48cd6",
      "new_mode": 33188,
      "new_path": "main/nss/nss.patch"
    },
    {
      "type": "modify",
      "old_id": "2392978403f957663dc124dcf3b0e8d4811c319f",
      "old_mode": 33188,
      "old_path": "main/nss/nss_freebsd.patch",
      "new_id": "7141d5872aa28d20c9d1a39e94d759411f0a83b5",
      "new_mode": 33188,
      "new_path": "main/nss/nss_freebsd.patch"
    },
    {
      "type": "modify",
      "old_id": "cc8cad2f21f87a676a2daf473a94faab63bad6d1",
      "old_mode": 33188,
      "old_path": "main/nss/nss_linux.patch",
      "new_id": "d68e724e1dcad6e422e3333f6cb20c9ce091e21f",
      "new_mode": 33188,
      "new_path": "main/nss/nss_linux.patch"
    },
    {
      "type": "modify",
      "old_id": "15a2bac890bc51c5ac278621e1cb5e8833e8ee8c",
      "old_mode": 33188,
      "old_path": "main/nss/nss_macosx.patch",
      "new_id": "7934a021748efb51e942865d12c6dbcb83aa4550",
      "new_mode": 33188,
      "new_path": "main/nss/nss_macosx.patch"
    },
    {
      "type": "delete",
      "old_id": "9806deb6f58d8be7ee9abf81a079359e4c6b02a8",
      "old_mode": 33188,
      "old_path": "main/nss/nss_sizes.patch",
      "new_id": "0000000000000000000000000000000000000000",
      "new_mode": 0,
      "new_path": "/dev/null"
    }
  ]
}