%{?mingw_package_header}
%define _pkg_name nss

Summary:	MinGW build of Network Security Services
Name:		mingw-%{_pkg_name}
Version:	3.38.0
Release:	1%{?dist}
License:	MPLv2.0
URL:		http://www.mozilla.org/projects/security/pki/nss/
BuildArch:	noarch
ExclusiveArch: %{ix86} x86_64
BuildRequires:	mingw32-nspr mingw64-nspr
BuildRequires:	mingw32-sqlite mingw64-sqlite
BuildRequires:	mingw32-zlib mingw64-zlib
BuildRequires:	mingw32-pkg-config mingw64-pkg-config
BuildRequires:	mingw32-filesystem >= 95
BuildRequires:	mingw64-filesystem >= 95
BuildRequires:	mingw32-gcc mingw64-gcc
BuildRequires:	gcc
BuildRequires:	perl-interpreter

Source0:	https://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/NSS_3_38_RTM/src/nss-3.38.0.tar.gz
Source1:        nss.pc.in
Source2:        nss-config.in
Source3:        blank-cert8.db
Source4:        blank-key3.db
Source5:        blank-secmod.db
Source6:        blank-cert9.db
Source7:        blank-key4.db
Source8:        system-pkcs11.txt
Source9:        setup-nsssysinit.sh
Source20:       nss-config.xml
Source21:       setup-nsssysinit.xml
Source22:       pkcs11.txt.xml
Source23:       cert8.db.xml
Source24:       cert9.db.xml
Source25:       key3.db.xml
Source26:       key4.db.xml
Source27:       secmod.db.xml
Source28:       nss-p11-kit.config

# Same patches as the native Fedora package
Patch2:           add-relro-linker-option.patch
Patch3:           renegotiate-transitional.patch
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=617723
Patch16:          nss-539183.patch
# Fedora / RHEL-only patch, the templates directory was originally introduced to support mod_revocator
Patch47:          utilwrap-include-templates.patch
# TODO remove when we switch to building nss without softoken
Patch49:          nss-skip-bltest-and-fipstest.patch
# This patch uses the GCC -iquote option documented at
# http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options
# to give the in-tree headers a higher priority over the system headers,
# when they are included through the quote form (#include "file.h").
#
# This ensures a build even when system headers are older. Such is the
# case when starting an update with API changes or even private export
# changes.
#
# Once the buildroot aha been bootstrapped the patch may be removed
# but it doesn't hurt to keep it.
Patch50:          iquote.patch
# Local patch for TLS_ECDHE_{ECDSA|RSA}_WITH_3DES_EDE_CBC_SHA ciphers
Patch58: rhbz1185708-enable-ecc-3des-ciphers-by-default.patch
# Upstream: https://bugzilla.mozilla.org/show_bug.cgi?id=1279520
Patch59: backport-policycheck-1474887-3.36.x.patch
Patch60: nss-check-policy-file.patch
Patch61: nss-load-policy-file.patch
Patch62: nss-skip-util-gtest.patch

# MinGW-specific patches
Patch1000:         nss-build.patch
# This fixes backport-policycheck-1474887-3.36.x.patch by backporting
# more stuff from upstream commit
# 'Bug 1474887, nss-policy-check: a tool to check a NSS policy configuration for errors, r=rrelyea'
Patch1001:         backport-mingw-NSSUTIL_AddNSSFlagToModuleSpec.patch


%description
Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Applications built with NSS can support SSL v2
and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509
v3 certificates, and other security standards.

%package -n mingw32-%{_pkg_name}
Summary:	%{summary}

%description -n mingw32-%{_pkg_name}
Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Applications built with NSS can support SSL v2
and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509
v3 certificates, and other security standards.

%package -n mingw64-%{_pkg_name}
Summary:	%{summary}

%description -n mingw64-%{_pkg_name}
Network Security Services (NSS) is a set of libraries designed to
support cross-platform development of security-enabled client and
server applications. Applications built with NSS can support SSL v2
and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509
v3 certificates, and other security standards.

%{?mingw_debug_package}

%prep
%setup -q -n %{_pkg_name}-%{version}

%patch2 -p0 -b .relro
%patch3 -p0 -b .transitional
%patch16 -p0 -b .539183
%patch47 -p0 -b .templates
%patch49 -p0 -b .skipthem
%patch50 -p0 -b .iquote
%patch58 -p0 -b .1185708_3des
pushd nss
%patch59 -p1 -b .policy
%patch60 -p1 -b .check_policy_file
%patch61 -p1 -b .load_policy_file
%patch62 -p1 -b .skip_util_gtest
popd

%patch1000 -p1
%patch1001 -p1

# Because this is a poorly-built library
pushd nss

mkdir -p ../build_win32
cp -R * ../build_win32

mkdir -p ../build_win64
cp -R * ../build_win64

%build
# Building for Win32
pushd build_win32

FREEBL_NO_DEPEND=0
export FREEBL_NO_DEPEND

NSS_DISABLE_GTESTS=1
export NSS_DISABLE_GTESTS

# Enable compiler optimizations and disable debugging code
BUILD_OPT=1
export BUILD_OPT

PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1

export PKG_CONFIG_ALLOW_SYSTEM_LIBS
export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS

%{mingw32_env}
NSPR_INCLUDE_DIR=`%{mingw32_target}-pkg-config --cflags-only-I nspr | sed 's/-I//'`
NSPR_LIB_DIR=`%{mingw32_target}-pkg-config --libs-only-L nspr | sed 's/-L//'`

export NSPR_INCLUDE_DIR
export NSPR_LIB_DIR

NSS_USE_SYSTEM_SQLITE=1
export NSS_USE_SYSTEM_SQLITE

USE_SYSTEM_ZLIB=1
ZLIB_LIBS=%{mingw32_libdir}/libz.dll.a
export USE_SYSTEM_ZLIB
export ZLIB_LIBS

(cd coreconf/nsinstall && gcc -o nsinstall nsinstall.c pathsub.c)

%{mingw32_make} OS_TARGET=WINNT OS_RELEASE=5.0 XP_WIN=1 \
	NSINSTALL=$(pwd)/coreconf/nsinstall/nsinstall NS_USE_GCC=1 \
	CC=%{mingw32_cc} CCC=%{mingw32_cxx} RC=%{mingw32_windres} RANLIB=%{mingw32_ranlib}

popd

# Building for Win64
pushd build_win64

FREEBL_NO_DEPEND=0
export FREEBL_NO_DEPEND

NSS_DISABLE_GTESTS=1
export NSS_DISABLE_GTESTS

# Enable compiler optimizations and disable debugging code
BUILD_OPT=1
export BUILD_OPT

PKG_CONFIG_ALLOW_SYSTEM_LIBS=1
PKG_CONFIG_ALLOW_SYSTEM_CFLAGS=1

export PKG_CONFIG_ALLOW_SYSTEM_LIBS
export PKG_CONFIG_ALLOW_SYSTEM_CFLAGS

%{mingw64_env}
NSPR_INCLUDE_DIR=`%{mingw64_target}-pkg-config --cflags-only-I nspr | sed 's/-I//'`
NSPR_LIB_DIR=`%{mingw64_target}-pkg-config --libs-only-L nspr | sed 's/-L//'`

export NSPR_INCLUDE_DIR
export NSPR_LIB_DIR

NSS_USE_SYSTEM_SQLITE=1
export NSS_USE_SYSTEM_SQLITE

USE_SYSTEM_ZLIB=1
ZLIB_LIBS=%{mingw64_libdir}/libz.dll.a
export USE_SYSTEM_ZLIB
export ZLIB_LIBS

(cd coreconf/nsinstall && gcc -o nsinstall nsinstall.c pathsub.c)

%{mingw64_make} OS_TARGET=WINNT OS_RELEASE=5.0 XP_WIN=1 \
	NSINSTALL=$(pwd)/coreconf/nsinstall/nsinstall NS_USE_GCC=1 USE_64=1 \
	CC=%{mingw64_cc} CCC=%{mingw64_cxx} RC=%{mingw64_windres} RANLIB=%{mingw64_ranlib}

popd

%install
export PKG_CONFIG_PATH=%{mingw64_libdir}/pkgconfig

mkdir -p %{buildroot}%{mingw32_libdir}/pkgconfig
mkdir -p %{buildroot}%{mingw64_libdir}/pkgconfig

# Manually create the .pc file
cat %{SOURCE1} | sed -e "s,%%libdir%%,%{mingw64_libdir},g" \
			-e "s,%%prefix%%,%{mingw64_prefix},g" \
			-e "s,%%exec_prefix%%,%{mingw64_prefix},g" \
			-e "s,%%includedir%%,%{mingw64_includedir}/nss3,g" \
			-e "s,%%NSPR_VERSION%%,4\.9\.4,g" \
			-e "s,%%NSS_VERSION%%,%{version},g" > \
			%{buildroot}%{mingw64_libdir}/pkgconfig/nss.pc
cat %{SOURCE1} | sed -e "s,%%libdir%%,%{mingw32_libdir},g" \
			-e "s,%%prefix%%,%{mingw32_prefix},g" \
			-e "s,%%exec_prefix%%,%{mingw32_prefix},g" \
			-e "s,%%includedir%%,%{mingw32_includedir}/nss3,g" \
			-e "s,%%NSPR_VERSION%%,4\.9\.4,g" \
			-e "s,%%NSS_VERSION%%,%{version},g" > \
			%{buildroot}%{mingw32_libdir}/pkgconfig/nss.pc

NSS_VMAJOR=`cat nss/lib/nss/nss.h \
	| grep "#define.*NSS_VMAJOR" \
	| awk '{print $3}'`
NSS_VMINOR=`cat nss/lib/nss/nss.h \
	| grep "#define.*NSS_VMINOR" \
	| awk '{print $3}'`
NSS_VPATCH=`cat nss/lib/nss/nss.h \
	| grep "#define.*NSS_VPATCH" \
	| awk '{print $3}'`


export NSS_VMAJOR
export NSS_VMINOR
export NSS_VPATCH

mkdir -p %{buildroot}%{mingw32_bindir}
mkdir -p %{buildroot}%{mingw64_bindir}

cat %{SOURCE2} | sed -e "s,@libdir@,%{mingw64_libdir},g" \
			-e "s,@prefix@,%{mingw64_prefix},g" \
			-e "s,@exec_prefix@,%{mingw64_prefix},g" \
			-e "s,@includedir@,%{mingw64_includedir}/nss3,g" \
			-e "s,@MOD_MAJOR_VERSION@,$NSS_VMAJOR,g" \
			-e "s,@MOD_MINOR_VERSION@,$NSS_VMINOR,g" \
			-e "s,@MOD_PATCH_VERSION@,$NSS_VPATCH,g" \
			> $RPM_BUILD_ROOT%{mingw64_bindir}/nss-config

cat %{SOURCE2} | sed -e "s,@libdir@,%{mingw32_libdir},g" \
			-e "s,@prefix@,%{mingw32_prefix},g" \
			-e "s,@exec_prefix@,%{mingw32_prefix},g" \
			-e "s,@includedir@,%{mingw32_includedir}/nss3,g" \
			-e "s,@MOD_MAJOR_VERSION@,$NSS_VMAJOR,g" \
			-e "s,@MOD_MINOR_VERSION@,$NSS_VMINOR,g" \
			-e "s,@MOD_PATCH_VERSION@,$NSS_VPATCH,g" \
			> %{buildroot}%{mingw32_bindir}/nss-config

chmod 755 %{buildroot}%{mingw64_bindir}/nss-config
chmod 755 %{buildroot}%{mingw32_bindir}/nss-config

# There is no 'make install' target, so we do it all manually
mkdir -p %{buildroot}%{mingw64_includedir}/nss3
mkdir -p %{buildroot}%{mingw64_bindir}
mkdir -p %{buildroot}%{mingw64_libdir}/nss

mkdir -p %{buildroot}%{mingw32_includedir}/nss3
mkdir -p %{buildroot}%{mingw32_bindir}
mkdir -p %{buildroot}%{mingw32_libdir}/nss

for file in softokn nss nssutil \
		ssl smime nssdbm
do
	install -m 755 dist/*x86_64*.OBJ/lib/${file}3.dll %{buildroot}%{mingw64_bindir}/
	install -m 644 dist/*x86_64*.OBJ/lib/lib${file}3.a %{buildroot}%{mingw64_libdir}/lib${file}3.dll.a

	install -m 755 dist/*i686*.OBJ/lib/${file}3.dll %{buildroot}%{mingw32_bindir}
	install -m 644 dist/*i686*.OBJ/lib/lib${file}3.a %{buildroot}%{mingw32_libdir}/lib${file}3.dll.a
done

install -m 755 dist/*x86_64*.OBJ/lib/nssckbi.dll %{buildroot}%{mingw64_bindir}/
install -m 755 dist/*x86_64*.OBJ/lib/freebl3.dll %{buildroot}%{mingw64_bindir}/

install -m 755 dist/*i686*.OBJ/lib/nssckbi.dll %{buildroot}%{mingw32_bindir}/
install -m 755 dist/*i686*.OBJ/lib/freebl3.dll %{buildroot}%{mingw32_bindir}/

# Install the empty NSS db files
mkdir -p %{buildroot}%{mingw64_sysconfdir}/pki/nssdb
mkdir -p %{buildroot}%{mingw32_sysconfdir}/pki/nssdb

install -m 644 %{SOURCE3} %{buildroot}%{mingw64_sysconfdir}/pki/nssdb/cert8.db
install -m 644 %{SOURCE4} %{buildroot}%{mingw64_sysconfdir}/pki/nssdb/key3.db
install -m 644 %{SOURCE5} %{buildroot}%{mingw64_sysconfdir}/pki/nssdb/secmod.db

install -m 644 %{SOURCE3} %{buildroot}%{mingw32_sysconfdir}/pki/nssdb/cert8.db
install -m 644 %{SOURCE4} %{buildroot}%{mingw32_sysconfdir}/pki/nssdb/key3.db
install -m 644 %{SOURCE5} %{buildroot}%{mingw32_sysconfdir}/pki/nssdb/secmod.db

# And more development files
for file in libcrmf.a libnssb.a libnssckfw.a
do
	install -m 644 dist/*x86_64*.OBJ/lib/${file} %{buildroot}%{mingw64_libdir}
	install -m 644 dist/*i686*.OBJ/lib/${file} %{buildroot}%{mingw32_libdir}
done

# The executable binaries
for file in certutil cmsutil crlutil modutil pk12util signtool signver ssltap
do
	install -m 755 dist/*x86_64*.OBJ/bin/${file}.exe %{buildroot}%{mingw64_bindir}
	install -m 755 dist/*i686*.OBJ/bin/${file}.exe %{buildroot}%{mingw32_bindir}
done

# And more, unsupported(?), binaries
for file in atob btoa derdump ocspclnt pp selfserv shlibsign strsclnt symkeyutil \
 tstclnt vfyserv vfychain
do
  install -m 755 dist/*x86_64*.OBJ/bin/${file}.exe %{buildroot}%{mingw64_libdir}/nss
  install -m 755 dist/*i686*.OBJ/bin/${file}.exe %{buildroot}%{mingw32_libdir}/nss
done

for file in dist/public/nss/*.h
do
	install -m 644 ${file} %{buildroot}%{mingw32_includedir}/nss3
done
for file in dist/public/nss/*.h
do
	install -m 644 ${file} %{buildroot}%{mingw64_includedir}/nss3
done

%files -n mingw32-%{_pkg_name}
%doc nss/COPYING
%{mingw32_bindir}/*.dll
%{mingw32_bindir}/*.exe
%{mingw32_bindir}/nss-config
%{mingw32_libdir}/*.a
%{mingw32_libdir}/pkgconfig/nss.pc
%{mingw32_libdir}/nss/
%{mingw32_includedir}/nss3
%{mingw32_sysconfdir}/pki/nssdb/*.db

%files -n mingw64-%{_pkg_name}
%doc nss/COPYING
%{mingw64_bindir}/*.dll
%{mingw64_bindir}/*.exe
%{mingw64_bindir}/nss-config
%{mingw64_libdir}/*.a
%{mingw64_libdir}/pkgconfig/nss.pc
%{mingw64_libdir}/nss/
%{mingw64_includedir}/nss3
%{mingw64_sysconfdir}/pki/nssdb/*.db

%changelog
* Fri Aug 17 2018 Victor Toso <victortoso@redhat.com> - 3.20-2
- ExclusiveArch: i686, x86_64
- Related: rhbz#1615874

* Wed Oct 07 2015 Fabiano Fidêncio <fidencio@redhat.com> - 3.20-1
- Update to 3.20

* Mon Jun 01 2015 Fabiano Fidêncio <fidencio@redhat.com> - 3.18.1-1
- Update to 3.18.1

* Tue Dec 11 2012 Greg Hellings <greg.hellings@gmail.com> - 3.14-1
- Initial build