nss (2:3.28.4-0ubuntu0.16.04.14) xenial-security; urgency=medium

  * SECURITY UPDATE: Out-of-bounds read
    - debian/patches/CVE-2020-12403-2.patch: fix incorrect call to ChaChaPoly1305 by PKCS11
      in nss/lib/freebl/chacha20poly1305.c.
    - CVE-2020-12403

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Fri, 21 Aug 2020 15:41:08 -0300

nss (2:3.28.4-0ubuntu0.16.04.13) xenial-security; urgency=medium

  * SECURITY UPDATE: Side-channel attack
    - debian/patches/CVE-2020-12400-and-6829-*.patch: use constant-time
      P-384 and P-521 in nss/lib/freebl/ecl/ecl-priv.h, nss/lib/freebl/ecl/ecl.c,
      nss/lib/freebl/ecl/ecl_spec384r1.c, nss/lib/freebl/freebl_base.gypi,
      nss/lib/freebl/manifest.mn, nss/test/ec/ectest.sh.
    - CVE-2020-12400
    - CVE-2020-6829
  * SECURITY UPDATE: Timing attack mitigation bypass
    - debian/patches/CVE-2020-12401.patch: remove unnecessary scalar
      padding in nss/lib/freebl/ec.c.
    - CVE-2020-12401

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Wed, 05 Aug 2020 16:20:52 -0300

nss (2:3.28.4-0ubuntu0.16.04.12) xenial-security; urgency=medium

  * SECURITY UPDATE: Side channel vulnerabilities during RSA key generation
    - debian/patches/CVE-2020-12402.patch: use constant-time GCD and
      modular inversion in nss/lib/freebl/mpi/mpi.c,
      nss/lib/freebl/mpi/mpi.h, nss/lib/freebl/mpi/mplogic.c.
    - CVE-2020-12402

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 22 Jun 2020 13:36:54 -0400

nss (2:3.28.4-0ubuntu0.16.04.11) xenial-security; urgency=medium

  * SECURITY UPDATE: Timing attack during DSA key generation
    - debian/patches/CVE-2020-12399.patch: force a fixed length for DSA
      exponentiation in nss/lib/freebl/dsa.c.
    - CVE-2020-12399

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 11 Jun 2020 09:45:43 -0400

nss (2:3.28.4-0ubuntu0.16.04.10) xenial-security; urgency=medium

  * SECURITY UPDATE: Possible wrong length for cryptographic primitives input
    - debian/patches/CVE-2019-17006.patch: adds checks for length of crypto
      primitives in nss/lib/freebl/chacha20poly1305.c,
      nss/lib/freebl/ctr.c, nss/lib/freebl/gcm.c,
      nss/lib/freebl/intel-gcm-wrap.c,
      nss/lib/freebl/rsapkcs.c.
    - CVE-2019-17006

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Tue, 07 Jan 2020 14:42:06 -0300

nss (2:3.28.4-0ubuntu0.16.04.9) xenial-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2019-17007.patch: check got some certs in
      collect_certs r=jcj in nss/lib/pkcs7/certread.c.
    - CVE-2019-17007

 -- Leonidas S. Barbosa <leo.barbosa@canonical.com>  Thu, 05 Dec 2019 13:25:47 -0300

nss (2:3.28.4-0ubuntu0.16.04.8) xenial-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds write in NSC_EncryptUpdate
    - debian/patches/CVE-2019-11745.patch: use maxout not block size in
      nss/lib/softoken/pkcs11c.c.
    - CVE-2019-11745
  * Note: this does _not_ contain the changes from
    2:3.28.4-0ubuntu0.16.04.7 in xenial-proposed.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 26 Nov 2019 08:53:56 -0500

nss (2:3.28.4-0ubuntu0.16.04.6) xenial-security; urgency=medium

  * SECURITY UPDATE: OOB read when importing a curve25519 private key
    - debian/patches/CVE-2019-11719.patch: don't unnecessarily strip
      leading 0's from key material during PKCS11 import in
      nss/lib/freebl/ecl/ecp_25519.c, nss/lib/pk11wrap/pk11akey.c,
      nss/lib/pk11wrap/pk11cert.c, nss/lib/pk11wrap/pk11pk12.c,
      nss/lib/softoken/legacydb/lgattr.c, nss/lib/softoken/pkcs11c.c.
    - CVE-2019-11719
  * SECURITY UPDATE: segfault via empty or malformed p256-ECDH public keys
    - debian/patches/CVE-2019-11729-1.patch: more thorough input checking
      in nss/lib/cryptohi/seckey.c, nss/lib/freebl/dh.c,
      nss/lib/freebl/ec.c, nss/lib/util/quickder.c.
    - CVE-2019-11729

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 12 Jul 2019 08:23:50 -0400

nss (2:3.28.4-0ubuntu0.16.04.5) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS in NULL pointer dereference in CMS functions
    - debian/patches/CVE-2018-18508-1.patch: add null checks in
      nss/lib/smime/cmscinfo.c, nss/lib/smime/cmsdigdata.c,
      nss/lib/smime/cmsencdata.c, nss/lib/smime/cmsenvdata.c,
      nss/lib/smime/cmsmessage.c, nss/lib/smime/cmsudf.c.
    - debian/patches/CVE-2018-18508-2.patch: add null checks in
      nss/lib/smime/cmsmessage.c.
    - CVE-2018-18508

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 19 Feb 2019 13:39:44 +0100

nss (2:3.28.4-0ubuntu0.16.04.4) xenial-security; urgency=medium

  * SECURITY UPDATE: side-channel attack on ECDSA signatures
    - debian/patches/CVE-2018-0495.patch: improve ecdsa and dsa in
      nss/lib/freebl/dsa.c, nss/lib/freebl/ec.c.
    - CVE-2018-0495
  * SECURITY UPDATE: ServerHello.random is all zero in v2 ClientHello
    - debian/patches/CVE-2018-12384-1.patch: fix random logic in
      nss/lib/ssl/ssl3con.c.
    - debian/patches/CVE-2018-12384-2.patch: add tests to
      nss/gtests/ssl_gtest/ssl_loopback_unittest.cc,
      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
    - CVE-2018-12384
  * SECURITY UPDATE: cache side-channel variant of the Bleichenbacher attack
    - debian/patches/CVE-2018-12404-1.patch: improve RSA key exchange
      handling in nss/lib/ssl/ssl3con.c.
    - debian/patches/CVE-2018-12404-3.patch: add constant time
      mp_to_fixlen_octets in nss/gtests/freebl_gtest/mpi_unittest.cc,
      nss/lib/freebl/mpi/mpi.c, nss/lib/freebl/mpi/mpi.h.
    - CVE-2018-12404

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 14 Dec 2018 09:59:33 -0500

nss (2:3.28.4-0ubuntu0.16.04.3) xenial-security; urgency=medium

  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
    - debian/patches/CVE-2017-7805.patch: Simplify handling of
      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
    - CVE-2017-7805

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 29 Sep 2017 08:54:11 -0400

nss (2:3.28.4-0ubuntu0.16.04.2) xenial-security; urgency=medium

  * SECURITY UPDATE: DoS via empty SSLv2 messages
    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
    - CVE-2017-7502

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 16 Jun 2017 08:13:46 -0400

nss (2:3.28.4-0ubuntu0.16.04.1) xenial-security; urgency=medium

  * Updated to upstream 3.28.4 to fix security issues and get a new CA
    certificate bundle.
  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
    - CVE-2016-2183
  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
    - CVE-2017-5461
  * debian/patches/*.patch: refreshed for new version.
  * debian/control: bump libnspr4-dev to 4.13.1.
  * debian/libnss3.symbols: added new symbols.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 26 Apr 2017 10:25:43 -0400

nss (2:3.26.2-0ubuntu0.16.04.2) xenial-security; urgency=medium

  * Updated to upstream 3.26.2 to fix security issues and get a new CA
    certificate bundle.
  * SECURITY UPDATE: denial of service via invalid DH keys
    - CVE-2016-5285
  * SECURITY UPDATE: small subgroup confinement attack
    - CVE-2016-8635
  * SECURITY UPDATE: insufficient mitigation of timing side-channel attack
    - CVE-2016-9074
  * debian/rules: added libfreeblpriv3.so.
  * debian/libnss3.symbols: updated for new version, added
    SSL_GetCipherSuiteInfo and SSL_GetChannelInfo as they are not backwards
    compatible.
  * debian/patches/*.patch: refreshed for new version.
  * debian/rules: When building with -O3, build with -Wno-error=maybe-
    uninitialized to fix FTBFS on ppc64el and powerpc.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Mon, 05 Dec 2016 07:17:18 -0500

nss (2:3.23-0ubuntu0.16.04.1) xenial-security; urgency=medium

  * Updated to upstream 3.23 to fix a security issue and get a new CA
    certificate bundle.
  * SECURITY UPDATE: multiple memory safety issues
    - CVE-2016-2834
  * debian/control: bump libnspr4-dev Build-Depends to 2:4.12.
  * debian/libnss3.symbols: updated for new version.
  * debian/patches/CVE-2016-1950.patch: dropped, upstream.
  * debian/patches/ftbfs_ppc64el.patch: dropped, no longer needed.
  * debian/patches/*.patch: refreshed for new version.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 07 Jul 2016 12:44:16 -0400

nss (2:3.21-1ubuntu4) xenial; urgency=medium

  * SECURITY UPDATE: buffer overflow during ASN.1 decoding
    - debian/patches/CVE-2016-1950.patch: check lengths in
      nss/lib/util/secasn1d.c.
    - CVE-2016-1950

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 09 Mar 2016 07:35:32 -0500

nss (2:3.21-1ubuntu3) xenial; urgency=medium

  * debian/patches/relax_dh_size.patch: removed, now require a minimum DH
    size of 1023 bits.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 18 Feb 2016 11:23:15 -0500

nss (2:3.21-1ubuntu2) xenial; urgency=medium

  * debian/patches/ftbfs_ppc64el.patch: don't enable -Werror on ppc64el,
    there are too many uninitialized variable false positives.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 26 Nov 2015 14:49:56 -0500

nss (2:3.21-1ubuntu1) xenial; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/rules:
      + Add x32 support.
      + Also ship blapi.h and alghmac.h in libnss3-dev.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: 
      + Add back support for shared cert and key databases.
    - debian/patches/relax_dh_size.patch: relax minimum DH size to 768 bits
      for compatibility reasons. This patch will get reverted in the future
      once servers have upgraded to longer DH sizes.
    - debian/control: remove cross Build Profile from Build-Depends, as it
      doesn't seem to be supported by launchpad yet.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 26 Nov 2015 08:55:09 -0500

nss (2:3.21-1) unstable; urgency=medium

  * New upstream release.
  * nss/lib/ssl/sslsock.c: Disable transitional scheme for SSL renegotiation.
    5 years after the transition started, it shouldn't be necessary anymore.
  * nss/lib/ckfw/builtins/certdata.txt: Remove the SPI CA.
  * nss/lib/util/secload.c: Fix a warning introduced by our patch to this file.
  * debian/libnss3.symbols: Add NSS_3.21 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Wed, 25 Nov 2015 09:18:30 +0900

nss (2:3.20.1-1) unstable; urgency=high

  * New upstream release.
  * Fixes mfsa2015-133. also known as CVE-2015-7181 and CVE-2015-7182.

 -- Mike Hommey <glandium@debian.org>  Wed, 04 Nov 2015 09:53:32 +0900

nss (2:3.20-1) unstable; urgency=medium

  * New upstream release.
  * Removed patch for __DATE__ and __TIME__ references from 2:3.19.1-1 because
    the parts that matter were applied upstream.
  * debian/rules: Move USE_64 to common make flags, and always use
    DEB_HOST_ARCH_BITS since it's even supported by dpkg in oldstable, now.
  * debian/libnss3.symbols: Add NSS_3.20 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Sat, 22 Aug 2015 09:02:11 +0900

nss (2:3.19.2.1-0ubuntu1) xenial; urgency=medium

  * Updated to upstream 3.19.2.1 to fix two security issues.
  * SECURITY UPDATE: use-after-poison in sec_asn1d_parse_leaf
    - CVE-2015-7181
  * SECURITY UPDATE: ASN.1 decoder heap overflow
    - CVE-2015-7182

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 04 Nov 2015 10:33:01 -0600

nss (2:3.19.2-1ubuntu1) wily; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/rules:
      + Add x32 support.
      + Also ship blapi.h and alghmac.h in libnss3-dev.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: 
      + Add back support for shared cert and key databases.
  * debian/patches/relax_dh_size.patch: relax minimum DH size to 768 bits
    for compatibility reasons. This patch will get reverted in the future
    once servers have upgraded to longer DH sizes.
  * debian/control: remove cross Build Profile from Build-Depends, as it
    doesn't seem to be supported by launchpad yet.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 08 Jul 2015 09:29:03 -0400

nss (2:3.19.2-1) unstable; urgency=medium

  * New upstream release.
  * debian/rules: Force set OS_TEST to DEB_HOST_GNU_CPU to avoid it defaulting
    to `uname -m`. Thanks Helmut Grohne. Closes: #788452

 -- Mike Hommey <glandium@debian.org>  Sun, 21 Jun 2015 06:30:13 +0900

nss (2:3.19.1-2) unstable; urgency=medium

  * debian/control: Fix Vcs-Git url.
  * nss/cmd/shlibsign/manifest.mn: Fix missing LIBRARY_VERSION.
  * nss/cmd/shlibsign/shlibsign.c: Fix shlibsign on arm64.

 -- Mike Hommey <glandium@debian.org>  Mon, 01 Jun 2015 16:25:07 +0900

nss (2:3.19.1-1) unstable; urgency=medium

  * New upstream release.
  * debian/libnss3.symbols:
    - Add NSS_3.19.1 symbol versions.
    - Reorder and replace *@ with (symver).
  * debian/rules:
    - Pass multi-arch dir for NSPR_LIB_DIR. Closes: #722811.
    - Set umask when calling shlibsign, and rearrange how it's being called.
    - Build nsinstall separately and set things up for cross-compilations.
    - Use native shlibsign when cross-compiling.
    - Do not run FIPS check on cross-builds.
  * debian/control: Build depend on native libnss3-tools for cross builds.
    Closes: #682926.
  * debian/libnss3-tools.manpages, debian/rules: Install the manpages that
    are now provided upstream. Closes: #505382.
  * debian/control: Update Vcs-* urls.
  * debian/control: Bump Standards-Version to 3.9.6.0. No changes required.
  * nss/lib/ckfw/builtins/binst.c, nss/lib/ckfw/builtins/ckbiver.c,
    nss/lib/ckfw/builtins/manifest.mn, nss/lib/ckfw/capi/ckcapiver.c,
    nss/lib/ckfw/capi/manifest.mn, nss/lib/ckfw/nssmkey/ckmkver.c,
    nss/lib/ckfw/nssmkey/manifest.mn, nss/lib/freebl/freeblver.c,
    nss/lib/freebl/ldvector.c, nss/lib/freebl/manifest.mn,
    nss/lib/nss/manifest.mn, nss/lib/nss/nssinit.c, nss/lib/nss/nssver.c,
    nss/lib/smime/manifest.mn, nss/lib/smime/smimeutil.c,
    nss/lib/smime/smimever.c, nss/lib/softoken/legacydb/lginit.c,
    nss/lib/softoken/manifest.mn, nss/lib/softoken/pkcs11.c,
    nss/lib/softoken/softkver.c, nss/lib/ssl/manifest.mn,
    nss/lib/ssl/sslcon.c, nss/lib/ssl/sslver.c, nss/lib/util/secoid.c: Remove
    __DATE__ and __TIME__ references.
  * nss/cmd/shlibsign/Makefile, nss/cmd/shlibsign/manifest.mn,
    nss/cmd/shlibsign/shlibsign.c: Fix shlibsign to properly load the sotfoken
    module.
  * debian/rules: Remove debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss from
    LD_LIBRARY_PATH when executing shlibsign, which can be done now with the
    fix above.

 -- Mike Hommey <glandium@debian.org>  Mon, 01 Jun 2015 09:47:58 +0900

nss (2:3.19-1ubuntu1) wily; urgency=medium

  * Merge from Debian unstable. Remaining changes:
    - debian/rules:
      + Add x32 support.
      + Also ship blapi.h and alghmac.h in libnss3-dev.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: 
      + Add back support for shared cert and key databases.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 21 May 2015 09:51:47 -0400

nss (2:3.19-1) unstable; urgency=medium

  * New upstream release.
  * debian/libnss3.symbols: Add NSS_3.19 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Wed, 13 May 2015 10:47:10 +0900

nss (2:3.18-1) experimental; urgency=medium

  * New upstream release. Closes: #782874.
  * debian/libnss3.symbols: Add NSS_3.18 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Mon, 20 Apr 2015 08:50:46 +0900

nss (2:3.17.4-1) experimental; urgency=medium

  * New upstream release.
  * Acknowledge NMU.

 -- Mike Hommey <glandium@debian.org>  Wed, 25 Feb 2015 16:52:33 +0900

nss (2:3.17.4-0ubuntu1) vivid; urgency=medium

  * SECURITY UPDATE: update to upstream 3.17.4 to get new CA certificate
    bundle, and to fix incorrect SHA-1 behaviour. (LP: #1423031)
  * Removed unneeded patches:
    - debian/patches/98_CVE-2014-1569.patch: included upstream.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 19 Feb 2015 07:32:50 -0500

nss (2:3.17.2-1.1ubuntu1) vivid; urgency=low

  * Merge from Debian unstable. (LP: #1407826) Remaining changes:
    - debian/rules:
      + Add x32 support.
      + Also ship blapi.h and alghmac.h in libnss3-dev.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: 
      + Add back support for shared cert and key databases.

 -- Artur Rona <ari-tczew@ubuntu.com>  Tue, 06 Jan 2015 00:15:08 +0100

nss (2:3.17.2-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix CVE-2014-1569. Closes: #773625.

 -- Matt Kraai <kraai@debian.org>  Sun, 21 Dec 2014 19:46:52 -0800

nss (2:3.17.2-1ubuntu1) vivid; urgency=low

  * Merge from Debian unstable. (LP: #1400181) Remaining changes:
    - debian/rules:
      + Add x32 support.
      + Also ship blapi.h and alghmac.h in libnss3-dev.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: 
      + Add back support for shared cert and key databases.

 -- Artur Rona <ari-tczew@ubuntu.com>  Mon, 08 Dec 2014 00:26:25 +0100

nss (2:3.17.2-1) unstable; urgency=medium

  * New upstream release.

 -- Mike Hommey <glandium@debian.org>  Sat, 18 Oct 2014 13:22:04 +0900

nss (2:3.17.1-1) unstable; urgency=high

  * New upstream release.
    - Fixes CVE-2014-1568.
    - Add support for ppc64el, with a non-broken patch. Closes: #745757.
  * debian/libnss3.symbols: Add NSSUTIL_3.17.1 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Wed, 24 Sep 2014 22:16:32 +0900

nss (2:3.17.1-0ubuntu1) utopic; urgency=medium

  * SECURITY UPDATE: update to 3.17.1
    - see USN-2361-1
  * debian/libnss3.symbols: updated for new version.
  * debian/patches/38_ppc64le.patch: removed, upstream.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 24 Sep 2014 15:35:00 -0400

nss (2:3.17-1ubuntu1) utopic; urgency=medium

  * Merge with Debian; remaining changes:
    - debian/rules: Add x32 support.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: Add back support for shared cert
      and key databases.
    - debian/rules: also ship blapi.h and alghmac.h in libnss3-dev.
  * Really add support for ppc64el.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 09 Sep 2014 16:11:12 +0200

nss (2:3.17-1) unstable; urgency=medium

  * New upstream release.
  * nss/coreconf/Linux.mk: Actually add support for ppc64el. Closes: #745757.

 -- Mike Hommey <glandium@debian.org>  Sun, 24 Aug 2014 08:41:37 +0900

nss (2:3.16.3-1.1) unstable; urgency=low

  * Non-maintainer upload to delayed.
  * Add support for ppc64el. Closes: #745757

 -- Andreas Barth <aba@ayous.org>  Mon, 18 Aug 2014 20:01:00 +0000

nss (2:3.16.3-1ubuntu1) utopic; urgency=medium

  * Merge with Debian, remaining changes:
    - debian/rules: Add x32 support.
    - debian/control, debian/libnss3-nssdb.*, debian/libnss3.symbols,
      debian/pkcs11.txt, debian/rules: Add back support for shared cert
      and key databases.
  * Dropped patches:
    - debian/patches/CVE-2014-1492.patch: upstream
    - debian/patches/95_add_spi_certs.patch: now equivalent to
      95_add_spi+cacert_ca_certs.patch
    - debian/patches/38_x32.patch: equivalent included upstream (except
      USE_X32 instead of USE_x32)
  * debian/rules: also ship blapi.h and alghmac.h in libnss3-dev.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 16 Jul 2014 13:05:53 -0400

nss (2:3.16.3-1) unstable; urgency=medium

  * New upstream release.
  * debian/libnss3.symbols: Add NSS_3.16.2 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Sun, 13 Jul 2014 09:24:12 +0900

nss (2:3.16.1-1) unstable; urgency=medium

  * New upstream release.
  * debian/libnss3.symbols: Add NSS_3.16.1 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Sat, 07 Jun 2014 17:24:57 +0900

nss (2:3.16-1) unstable; urgency=medium

  * New upstream release.
  * debian/libnss3.symbols: Add NSS_3.16 symbol versions.
  * nss/lib/ckfw/builtins/certdata.txt: Remove CACert root certificates.

 -- Mike Hommey <glandium@debian.org>  Fri, 21 Mar 2014 08:10:24 +0900

nss (2:3.15.4-2) unstable; urgency=high

  * Upstream release 3.15.4 fixed MFSA-2014-12, also known as CVE-2014-1490
    and CVE-2014-1491. Bumping urgency as such.
  * debian/control, debian/libnss3-nssdb.*, debian/pkcs11.txt, debian/rules:
    Revert changes from 2:3.15.4-1. Reopens: #537866, Closes: #735329, #736061.

 -- Mike Hommey <glandium@debian.org>  Wed, 05 Feb 2014 16:26:06 +0900

nss (2:3.15.4-1ubuntu7) trusty; urgency=medium

  * SECURITY UPDATE: incorrect IDNA wildcard handling
    - debian/patches/CVE-2014-1492.patch: conform to RFC 6125 in
      nss/lib/certdb/certdb.c.
    - CVE-2014-1492

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 02 Apr 2014 10:14:01 -0400

nss (2:3.15.4-1ubuntu6) trusty; urgency=medium

  * No longer ship cacert.org certificates. (LP: #1258286)
    - removed debian/patches/95_add_spi+cacert_ca_certs.patch
    - added debian/patches/95_add_spi_certs.patch

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 20 Feb 2014 07:38:51 -0500

nss (2:3.15.4-1ubuntu5) trusty; urgency=medium

  * debian/rules: Switch from DEB_BUILD_ARCH to DEB_HOST_ARCH to fix cross.

 -- Adam Conrad <adconrad@ubuntu.com>  Sat, 25 Jan 2014 21:08:34 -0700

nss (2:3.15.4-1ubuntu4) trusty; urgency=medium

  * control: Mark libnss3-nssdb as M-A: foreign. (LP: #1272292)

 -- Timo Aaltonen <tjaalton@ubuntu.com>  Fri, 24 Jan 2014 14:13:10 +0200

nss (2:3.15.4-1ubuntu3) trusty; urgency=medium

  * debian/rules: create directory before creating cert database to fix
    ftbfs

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Jan 2014 13:22:01 -0500

nss (2:3.15.4-1ubuntu2) trusty; urgency=medium

  * debian/rules: switch back to DEB_BUILD_ARCH to fix ftbfs

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Jan 2014 12:39:23 -0500

nss (2:3.15.4-1ubuntu1) trusty; urgency=medium

  * Merge with Debian, remaining changes:
    - Add x32 support.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 23 Jan 2014 11:32:47 -0500

nss (2:3.15.4-1) unstable; urgency=low

  * New upstream release.
  * Acknowledge NMU.
  * debian/rules: Avoid long one-liner with semi-colons.
  * debian/patches/*:  Refresh patches.
  * debian/copyright: Update. Closes: #730428.
  * debian/control, debian/libnss3-nssdb.*, debian/pkcs11.txt, debian/rules:
    Add shared cert and key databases. Thanks Timo Aaltonen. Closes: #537866.
  * debian/rules: Use DEB_HOST_ARCH instead of DEB_BUILD_ARCH.
  * debian/control: Mark libnss3-dev as Multi-Arch: same. Thanks Shawn
    Landden. Closes: #682925.
  * debian/libnss3.symbols: Add NSS_3.15.4 symbol versions.

 -- Mike Hommey <glandium@debian.org>  Mon, 13 Jan 2014 10:46:04 +0900

nss (2:3.15.3.1-1.1ubuntu1) trusty; urgency=medium

  * Add x32 support. Closes: #699217.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 06 Jan 2014 21:27:26 +0100

nss (2:3.15.3.1-1.1) unstable; urgency=low

  * Non-Maintainer Upload
   - ship extra NSS utilities (Closes: #701141)

 -- Daniel Kahn Gillmor <dkg@fifthhorseman.net>  Sat, 04 Jan 2014 11:34:41 -0500

nss (2:3.15.3.1-1) unstable; urgency=high

  * New upstream release.
    - Distrusts AC DG Tresor SSL CA.

 -- Mike Hommey <glandium@debian.org>  Sun, 15 Dec 2013 10:09:48 +0900

nss (2:3.15.3-1) unstable; urgency=high

  * New upstream release.
    - Fixes CVE-2013-1741, CVE-2013-5605, CVE-2013-5606.

 -- Mike Hommey <glandium@debian.org>  Sat, 16 Nov 2013 08:50:45 +0900

nss (2:3.15.2-1) unstable; urgency=low

  * New upstream release.
    - Fixes CVE-2013-1739. Closes: #726473.

 -- Mike Hommey <glandium@debian.org>  Mon, 21 Oct 2013 08:05:24 +0900

nss (2:3.15.1-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*:  Refresh patches.
  * debian/patches/lower-dhe-priority.patch: Removed, as it was only necessary
    for Iceweasel 3.5, which is long gone.

 -- Mike Hommey <glandium@debian.org>  Mon, 05 Aug 2013 14:41:14 +0900

nss (2:3.15-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*: Refresh patches and removed unused ones.
  * debian/rules: Adjusted to the new source layout.
  * debian/libnss3.symbols: Add NSS*_3.15 symbol versions.
  * debian/control: Bump nspr build dependency.

 -- Mike Hommey <glandium@debian.org>  Sat, 15 Jun 2013 19:23:12 +0900

nss (2:3.14.3-1) unstable; urgency=high

  * New upstream release.
    - Fixes TLS timing attack (luck 13). Closes: #699888.
  * debian/libnss3.symbols: Add NSS_3.14.3 symbol version.
  * debian/control: Unbump sqlite3 build dependency, 3.14.3 lifted the need
    for sqlite 3.7.15.

 -- Mike Hommey <glandium@debian.org>  Sun, 17 Mar 2013 15:01:06 +0100

nss (2:3.14.2-1) unstable; urgency=low

  * New upstream release.
  * debian/control: Bump sqlite3 build dependency.
  * debian/rules: Avoid installing freebl, softokn, nssckbi and nssdbm in two
    places.
  * debian/libnss3-1d.lintian-overrides.in: Stop preprocessing, it has nothing
    to preprocess anymore.
  * debian/libnss3.lintian-overrides.in: Fix not to contain a reference to the
    libnss3-1d package.

 -- Mike Hommey <glandium@debian.org>  Fri, 15 Feb 2013 10:06:59 +0100

nss (2:3.14.1.with.ckbi.1.93-1) unstable; urgency=low

  * New upstream release.
    - Explicitly distrust two intermediate CA certificates mis-issued by
      TURKTRUST.
  * debian/patches/95_add_spi+cacert_ca_certs.patch: Refreshed.

 -- Mike Hommey <glandium@debian.org>  Fri, 04 Jan 2013 11:16:33 +0100

nss (2:3.14.1-1) unstable; urgency=low

  * New upstream release.
  * debian/patches: Removed patches applied upstream, and refreshed
    the others.
  * debian/libnss3.symbols: Updated for new symbols.

 -- Mike Hommey <glandium@debian.org>  Sun, 23 Dec 2012 17:40:21 +0100

nss (2:3.14-2) unstable; urgency=low

  * debian/nss-config.in: Fix nss-config when version is in the x.y form
    instead of x.y.z.

 -- Mike Hommey <glandium@debian.org>  Fri, 07 Dec 2012 17:07:05 +0100

nss (2:3.14-1) unstable; urgency=low

  * New upstream release.
  * debian/patches: Removed patches applied upstream, and refreshed
    the others.
  * debian/libnss3.symbols: Updated for new symbols.

 -- Mike Hommey <glandium@debian.org>  Thu, 01 Nov 2012 10:37:39 +0100

nss (2:3.13.6-1) unstable; urgency=low

  * New upstream release.
  * debian/rules: Use xz compression for binary packages.
    Thanks Ansgar Burchardt. Closes: #683835.

 -- Mike Hommey <glandium@debian.org>  Fri, 31 Aug 2012 09:56:53 +0200

nss (2:3.13.5-1) unstable; urgency=low

  * New upstream release.

 -- Mike Hommey <glandium@debian.org>  Fri, 15 Jun 2012 09:40:00 +0200

nss (2:3.13.4-3) unstable; urgency=low

  * debian/rules: Skip epoch when getting upstream version number.

 -- Mike Hommey <glandium@debian.org>  Sun, 20 May 2012 07:36:11 +0200

nss (2:3.13.4-2) unstable; urgency=low

  * debian/control, debian/libnss3*, debian/rules,
    mozilla/security/coreconf/*, mozilla/security/nss/lib/*/manifest.mn:
    Move to unversioned library. ABI compatibility is ensured upstream, and
    the SO version, if it needed a change at any time, would be a change in
    the library name. There is no reason to keep making compatibility more
    difficult with other distros and upstream binary releases. While previous
    versions were one-way compatible (binaries built against other distros or
    upstream nspr could work on Debian), this approach works both ways.
  * debian/control:
    - Bump Standards-Version to 3.9.3.0. No changes required.
    - Force to build against libnspr4-dev >= 2:4.9
  * Removed unapplied patches.
  * Adding an epoch to match the old libnss3 package that used to be in
    the Debian archive.

 -- Mike Hommey <glandium@debian.org>  Thu, 17 May 2012 09:45:36 +0200

nss (3.13.4-1) unstable; urgency=low

  * New upstream release.
    - Changed __GNUC_MINOR__ use in pkcs11n.h. Closes: #650319.
  * mozilla/security/nss/cmd/certcgi/certcgi.c,
    mozilla/security/nss/cmd/digest/digest.c,
    mozilla/security/nss/cmd/signver/pk7print.c: Import patch from Moritz
    Muehlenhoff for hardened format strings.
  * debian/make.mk, debian/rules, debian/control: Enable hardening.
    Closes: #657325.
  * debian/libnss3-1d.lintian-overrides.in, debian/rules: Use wildcards in
    lintian override. Closes: #670013.
  * debian/compat, debian/control: Bump debian/compat to 9. This has the
    effect of using build-id for debug files, thus Closes: #670015.
  * debian/libnss3-1d.symbols: Add symbols for /usr/lib/nss/ libraries.

 -- Mike Hommey <glandium@debian.org>  Sun, 29 Apr 2012 09:48:58 +0200

nss (3.13.3-1) unstable; urgency=low

  * New upstream release.
  * debian/libnss3-1d.symbols: Updated to fit new upstream.

 -- Mike Hommey <glandium@debian.org>  Fri, 24 Feb 2012 09:56:10 +0100

nss (3.13.2~beta1-3) experimental; urgency=low

  * debian/libnss3-1d.symbols: Fix symbol version for the symbol added in
    -2.

 -- Mike Hommey <glandium@debian.org>  Fri, 23 Dec 2011 19:20:23 +0100

nss (3.13.2~beta1-2) experimental; urgency=low

  * mozilla/security/nss/lib/ssl/*,
    mozilla/security/nss/cmd/tstclnt/tstclnt.c,
    mozilla/security/nss/tests/ssl/ssl.sh: Apply patches from bz#542832,
    required for Iceweasel 11.
  * debian/libnss3-1d.symbols: Add corresponding symbol.

 -- Mike Hommey <glandium@debian.org>  Fri, 23 Dec 2011 17:54:03 +0100

nss (3.13.2~beta1-1) experimental; urgency=low

  * New upstream snapshot, picked from NSS_3_13_2_BETA1 cvs tag.
  * debian/libnss3-1d.symbols: Add NSS 3.13.2 symbols.

 -- Mike Hommey <glandium@debian.org>  Fri, 23 Dec 2011 16:22:05 +0100

nss (3.13.1.with.ckbi.1.88-1) unstable; urgency=low

  * New upstream release.
    - Distrusts malaysian Digicert Sdn. Bhd CA certificate.
    - Addresses CVE-2011-3640 (Untrusted search path vulnerability).
      Closes: #647614.
  * debian/patches/*: Refreshed patches.
  * debian/libnss3-1d.symbols: Add NSS 3.13 symbols.

 -- Mike Hommey <glandium@debian.org>  Sat, 05 Nov 2011 17:05:26 +0100

nss (3.12.11-3) unstable; urgency=high

  * mozilla/security/nss/lib/ckfw/builtins/certdata.*:
    Explicitely distrust various DigiNotar CAs:
    - DigiNotar Root CA
    - DigiNotar Services 1024 CA
    - DigiNotar Cyber CA
    - DigiNotar Cyber CA 2nd
    - DigiNotar PKIoverheid
    - DigiNotar PKIoverheid G2

 -- Mike Hommey <glandium@debian.org>  Sat, 03 Sep 2011 09:33:28 +0200

nss (3.12.11-2) unstable; urgency=high

  * mozilla/security/nss/lib/ckfw/builtins/certdata.*:
    Remove DigiNotar Root CA.

 -- Mike Hommey <glandium@debian.org>  Wed, 31 Aug 2011 08:49:00 +0200

nss (3.12.11-1) unstable; urgency=low

  * New upstream release.
  * mozilla/security/nss/lib/ckfw/builtins/certdata.*,
  * mozilla/security/coreconf/{config,Linux}.mk: Refreshed.
  * debian/copyright: Update dbm license according to that in the source.
    Closes: #624310

 -- Mike Hommey <glandium@debian.org>  Fri, 12 Aug 2011 12:45:08 +0200

nss (3.12.10-3) unstable; urgency=low

  * debian/nss-config.in, debian/nss.pc.in, debian/rules: Return the multiarch
    path in nss-config and nss.pc.

 -- Mike Hommey <glandium@debian.org>  Thu, 21 Jul 2011 18:08:48 +0200

nss (3.12.10-2) unstable; urgency=low

  * debian/control, debian/libnss3-1d.dirs,
    debian/libnss3-1d.lintian-overrides.in, debian/libnss3-dev.dirs,
    debian/libnss3-1d.links.in, debian/libnss3-dev.links.in,
    debian/rules: Switch to multi-arch while keeping backports easy.
    Closes: #497088.

 -- Mike Hommey <glandium@debian.org>  Mon, 04 Jul 2011 11:24:18 +0200

nss (3.12.10-1) unstable; urgency=low

  * New upstream release.
  * mozilla/security/nss/lib/ckfw/builtins/certdata.*: Refreshed.
  * debian/control: Build depend on libnspr4-dev >= 4.8.8.
  * debian/libnss3-1d.symbols: Add new symbol version.

 -- Mike Hommey <glandium@debian.org>  Wed, 25 May 2011 10:20:59 +0200

nss (3.12.9.with.ckbi.1.82-1) unstable; urgency=low

  * New upstream release.
    - Marks fraudulent Comodo certificates as untrusted.
  * mozilla/security/nss/lib/ckfw/builtins/certdata.*: Refreshed.

 -- Mike Hommey <glandium@debian.org>  Thu, 24 Mar 2011 16:37:46 +0100

nss (3.12.9-2) unstable; urgency=low

  * Upload to unstable.
  * debian/rules: Fallback to DEB_BUILD_ARCH when dpkg-architecture does't
    support DEB_BUILD_ARCH_BITS.
  * debian/control: Lower build depends on dpkg-dev to (>= 1.13.19), which
    was the previous value.
  * mozilla/security/nss/lib/freebl/unix_rand.c: We don't need to prevent
    using netstat for entropy seeding. The seeding will stop before netstat
    if it could get data from /dev/urandom.
  * mozilla/security/coreconf/Linux.mk: We shouldn't need to special case
    mips64 anymore.
  * mozilla/security/nss/cmd/shlibsign/Makefile, debian/rules: Don't rely
    on patching the source to not create .chk files during build.

 -- Mike Hommey <glandium@debian.org>  Sun, 06 Mar 2011 09:58:41 +0100

nss (3.12.9-1) experimental; urgency=low

  * New upstream release.

 -- Mike Hommey <glandium@debian.org>  Sat, 15 Jan 2011 11:33:35 +0100

nss (3.12.9~beta2-1) experimental; urgency=low

  * New upstream snapshot, picked from NSS_3_12_9_BETA2 cvs tag.
  * debian/patches/*: Refresh patches.
  * debian/libnss3-1d.symbols: Add new symbol versions.
  * debian/rules: Bump shlibs.

 -- Mike Hommey <glandium@debian.org>  Fri, 17 Dec 2010 15:01:31 +0100

nss (3.12.8-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*: Refresh patches.
  * debian/patches/series:
    + lower-dhe-priority.patch: Upstream patch from bz#583337 to lower DHE
      priority. Closes: #592315.

 -- Mike Hommey <glandium@debian.org>  Thu, 07 Oct 2010 08:50:48 +0200

nss (3.12.8~b2-1) experimental; urgency=low

  * New upstream snapshot, picked from NSS_3_12_8_BETA2 cvs tag.
  * debian/patches/*: Refresh patches.

 -- Mike Hommey <glandium@debian.org>  Mon, 23 Aug 2010 18:11:12 +0200

nss (3.12.7-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*: Refresh patches.
  * debian/control:
    - Bump Standards-Version to 3.9.1.0.
    - Build depend on libnspr4-dev >= 4.8.6.
  * debian/libnss3-1d.symbols: Simplify symbols file and add new symbols.
  * debian/rules: Bump shlibs.

 -- Mike Hommey <glandium@debian.org>  Fri, 06 Aug 2010 13:55:14 +0200

nss (3.12.6-3) unstable; urgency=low

  * debian/rules:
    + Sign libnssdbm3.so. Closes: #588806.
    + Test that the FIPS mode can be properly enabled during build.
  * debian/control:
    + Remove conflicts with very old packages.
    + Bump Standards-Version to 3.9.0.0.

 -- Mike Hommey <glandium@debian.org>  Mon, 12 Jul 2010 15:12:24 +0200

nss (3.12.6-2) unstable; urgency=low

  * debian/patches/series:
    + 00_ckbi_1.79.patch: New patch to update CKBI to 1.79.
    + 95_add_spi+cacert_ca_certs.patch: Refreshed against CKBI 1.79.

 -- Mike Hommey <glandium@debian.org>  Fri, 09 Apr 2010 10:45:01 +0200

nss (3.12.6-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/*: Refresh patches.
  * debian/libnss3-1d.symbols, debian/rules: Update symbols file with new
    symbols and bump shlibs.
  * debian/patches/97_SSL_RENEGOTIATE_TRANSITIONAL.patch,
    debian/patches/series: Enable transitional scheme for ssl renegotiation.
    Closes: #561918.
  * debian/control:
    + Bump Standards-Version to 3.8.4.0.
    + Drop libnss3-1d dependency on dpkg. The versions it didn't really like
      were between oldstable and stable.
    + Don't allow different versions of libnss3-1d, libnss3-1d-dbg and
      libnss3-tools to be installed at the same time.
    + Add ${misc:Depends} to libnss3-1d-dbg dependencies.
  * debian/rules: Revert workaround for gcc 4.4 bug on powerpc with -Os.
  * debian/rules, debian/control, debian/compat: Simplify debian/rules by
    using dh.

 -- Mike Hommey <glandium@debian.org>  Wed, 17 Mar 2010 20:33:32 +0100

nss (3.12.5-2) unstable; urgency=low

  * debian/control:
    + Remove build dependency on autotools-dev, we don't use it.
    + libnss3-dev depends on libnspr4-dev >= 4.6.6-1. 4.6.6-1 was the first
      version where the pkg-config file was nspr.pc instead of
      xulrunner-nspr.pc. Closes: #567134.
  * debian/patches/96_NSS_VersionCheck.patch, debian/patches/series:
    Remove runtime check of NSPR version in NSS_VersionCheck, which seems to
    be pointless. Closes: #567136.

 -- Mike Hommey <glandium@debian.org>  Thu, 28 Jan 2010 12:12:35 +0100

nss (3.12.5-1) unstable; urgency=low

  * New upstream release.
  * debian/copyright: Modify with new location for the embedded copy of zlib.
  * debian/patches/*:
    + Adapt patches to new upstream.
    + Switch to quilt format
  * debian/source/format: Switch to 3.0 (quilt) format.
  * debian/rules, debian/control: Stop using dpatch.
  * debian/patches/38_intel_aes_executable_stack.patch: Removed. An upstream
    change in version 3.12.4 obsoleted it.
  * debian/rules:
    + Remove DEB_{BUILD,HOST}_* variables, they are not used.
    + Use DEB_BUILD_ARCH_BITS to determine whether to build with USE_64 or not.
    + Ship more tools in libnss3-tools. Closes: #526267.
    + Work around gcc 4.4 bug on powerpc with -Os.
    + Force non parallel build. There are too many race conditions in the
      build system to support parallel builds. Closes: #536248.
    + Bump shlibs.
  * debian/control:
    + Bump Standards-Version to 3.8.3.0.
    + Build-depend on dpkg-dev (>= 1.15.4) for DEB_BUILD_ARCH_BITS.
    + Stricter dependency between libnss3-dev and libnss3-1d.
  * debian/libnss3-1d.symbols:
    + Add new symbols.
    + Remove debian revision for symbols added in 3.12.4.
  * debian/patches/38_hurd.patch: Fix FTBFS on Hurd due to PATH_MAX usage in
    unix_rand.c. Closes: #550995.

 -- Mike Hommey <glandium@debian.org>  Fri, 18 Dec 2009 11:48:14 +0100

nss (3.12.4-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/38_kbsd.dpatch:
    + Use CHECK_FORK_PTHREAD on kfreebsd and hurd. Closes: #547301.
    + Adapt to upstream changes.
  * debian/patches/95_add_spi+cacert_ca_certs.dpatch,
  * debian/patches/81_sonames.dpatch: Adapt to upstream changes.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols.
  * debian/rules: Bumped shlibs.

 -- Mike Hommey <glandium@debian.org>  Sun, 11 Oct 2009 01:26:14 +0200

nss (3.12.3.1-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/95_add_spi+cacert_ca_certs.dpatch, Adapted to upstream
    changes.

 -- Mike Hommey <glandium@debian.org>  Fri, 21 Aug 2009 23:47:24 +0200

nss (3.12.3-1) unstable; urgency=low

  * New upstream release.
  * debian/watch: Updated to catch new upstream .bz2 tarballs.
  * debian/copyright: Add information about
    mozilla/security/corecond/mkdepend.
  * debian/patches/38_hurd.dpatch, debian/patches/38_kbsd.dpatch: Adapted
    to upstream changes.
  * debian/patches/85_security_load.dpatch: Load libsoftokn3.so from
    /usr/lib/nss when unable to load it from standard ld.so paths in
    shlibsign.
  * debian/rules:
    + Add debian/libnss3-1d/usr/lib/nss to LD_LIBRARY_PATH when running
      shlibsign during build.
    + Bumped shlibs.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols.
  * debian/control:
    + Bumped Standards-Version to 3.8.1.0. No changes needed.
    + Put the libnss3-1d-dbg package in the "debug" section.
    + Correct libnss3-1d-dbg short description.
    + Remove redundant section on libnss3-1d.
    + Build-depend on proper version of debhelper for dh_lintian.
  * debian/*.lintian-overrides, debian/rules: Install some Lintian
    overrides with dh_lintian.
  * debian/patches/38_intel_aes_executable_stack.dpatch: Indicate that
    we don't need executable stack in intel-aes.s.
  * debian/patches/00list: Updated accordingly.

 -- Mike Hommey <glandium@debian.org>  Sat, 18 Apr 2009 09:37:31 +0200

nss (3.12.2.with.ckbi.1.73-2) unstable; urgency=low

  * mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_object.h:
    Apply patch from upstream to fix alignment issues on sparc and ia64.
    Closes: #509930.

 -- Mike Hommey <glandium@debian.org>  Mon, 06 Apr 2009 20:24:01 +0200

nss (3.12.2.with.ckbi.1.73-1) unstable; urgency=low

  * debian/patches/38_kbsd.dpatch: Brown paper bag fix for regression
    in previous release that led to FTBFS on i386 only. Closes: #513101.
    Thanks Steffen Joeris, Sebastian Andrzej Siewior and Petr Salinger.
  * debian/patches/95_add_spi+cacert_ca_certs.dpatch,
    debian/patches/80_security_tools.dpatch: Adapted to upstream changes.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols.
  * debian/rules: Bumped shlibs.

 -- Mike Hommey <glandium@debian.org>  Sat, 31 Jan 2009 16:41:26 +0100

nss (3.12.1-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/95_add_spi+cacert_ca_certs.dpatch,
    debian/patches/38_mips64_build.dpatch,
    debian/patches/38_kbsd.dpatch: Adapted to upstream changes.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols.
  * debian/rules: Bumped shlibs.

 -- Mike Hommey <glandium@debian.org>  Sat, 20 Dec 2008 12:11:28 +0100

nss (3.12.0-5) unstable; urgency=low

  * debian/control:
    + Conflict with libnss3-0d >= 3.11.5, that has conflicting files in
      /usr/lib/nss. Older versions (those from etch) don't conflict.
      This makes updates from old testing smoother. Closes: #492332.
    + Build-depend on libsqlite3-dev >= 3.3.9, since API introduced in this
      version is used. Closes: #493191.

 -- Mike Hommey <glandium@debian.org>  Sun, 03 Aug 2008 09:42:03 +0200

nss (3.12.0-4) unstable; urgency=low

  * debian/control: Remove conflict with libnss3-0d, it was only useful when
    libnss3-0d was a transitional package. Closes: #490995.

 -- Mike Hommey <glandium@debian.org>  Wed, 16 Jul 2008 21:29:19 +0200

nss (3.12.0-3) unstable; urgency=low

  * debian/rules:
    + Enable ECC cypher suite. Closes: #490826.
    + Build with the same optimization level as upstream.

 -- Mike Hommey <glandium@debian.org>  Mon, 14 Jul 2008 17:35:25 +0200

nss (3.12.0-2) unstable; urgency=low

  * debian/patches/95_add_spi+cacert_ca_certs.dpatch:
    + Add CAcert root and class 3 certificates to nssckbi module.
    + Add SPI Inc. certificate to nssckbi module.
    Thanks to Martin F Krafft for these. Closes: #309564.
  * debian/patches/00list: Updated accordingly.

 -- Mike Hommey <glandium@debian.org>  Sat, 12 Jul 2008 18:26:09 +0200

nss (3.12.0-1) unstable; urgency=low

  * New upstream release.
  * debian/patches/92_ocsp.dpatch: Removed, as applied upstream.
  * debian/patches/00list: Updated accordingly.
  * debian/control:
    + Bumped Standards-Version to 3.8.0.1. No changes needed.
    + Added Vcs-Browser and Vcs-Git fields.
    + libnss3-dev don't need explicit version dependency on libnss3-1d.
    + libnss3-dev depends on libnspr4-dev. Closes: #488402.
    + Make the -dbg package less a hassle for manual installations with dpkg.
    + libnss3-1d depends on version of dpkg that either don't support symbols
      files or has fix for #474079.
  * debian/patches/85_security_load.dpatch: Load files from /usr/lib/nss if
    given reference path is only a filename, which happens when freebl is
    statically linked in a binary executable, such as signtool, and the
    executable is run from $PATH. When the executable is run using a full
    path, we must replace /bin/ in the path with /lib/ to find the libraries.
    Closes: #483774.
  * debian/libnss3-1d.symbols: Re-enable symbols file.

 -- Mike Hommey <glandium@debian.org>  Sat, 05 Jul 2008 10:19:53 +0200

nss (3.12.0~rc3-3) unstable; urgency=low

  * debian/control: Make libnss3-0d conflict with old libnss3, which can
    still be installed on some systems, though it hasn't been in the archive 
    since sarge. Closes: #485080.

 -- Mike Hommey <glandium@debian.org>  Sun, 08 Jun 2008 14:11:13 +0200

nss (3.12.0~rc3-2) unstable; urgency=low

  * debian/patches/92_ocsp.dpatch: Apply patches from bz433594 and bz#433386,
    which are applied in upstream RC4 (and are the only changes), to fix
    crashes under some conditions with OCSP checks.
  * debian/patches/00list: Updated accordingly.
  * debian/libnss3-dev.links, debian/libnss3-1d.links: Don't install so
    files in the -dev package but in the library package. It will allow
    external applications linked against upstream nss to work on Debian with
    system nss libraries, and will avoid all browsers to have to implement
    symlinks themselves to allow some external plugins to work properly.
  * debian/control: Make libnss3-1d conflict with older versions of
    libnss3-dev and libnss3-dev need newer libnss3-1d accordingly.

 -- Mike Hommey <glandium@debian.org>  Sat, 07 Jun 2008 11:57:55 +0200

nss (3.12.0~rc3-1) unstable; urgency=low

  * New upstream snapshot, picked from NSS_3_12_RC3 cvs tag.

 -- Mike Hommey <glandium@debian.org>  Sun, 11 May 2008 16:58:17 +0200

nss (3.12.0~beta3-1) unstable; urgency=low

  * New upstream snapshot, picked from NSS_3_12_BETA3 cvs tag.
  * debian/control: Turn Homepage indications in descriptions into a
    control field.
  * debian/patches/91_build_pwdecrypt.dpatch: Enable building and installing
    pwdecrypt. Thanks Paul Wise. Closes: #472303.
  * debian/patches/00list: Updated accordingly.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols and rename
    the file, so that it isn't used, as a workaround to #474079.
    Closes: #474007.
  * debian/rules: Bumped shlibs.

 -- Mike Hommey <glandium@debian.org>  Tue, 08 Apr 2008 21:23:53 +0200

nss (3.12.0~beta2-1) unstable; urgency=low

  * New upstream snapshot, picked from NSS_3_12_BETA2 cvs tag.
  * debian/patches/10_3.11.7_symbol_fix.dpatch: Removed, as applied upstream.
  * debian/patches/38_kbsd.dpatch: Adapted to upstream changes.
  * debian/patches/81_sonames.dpatch: Add SO_VERSION to libnssutil3.
  * debian/libnss3-dev.links: Add link for libnssutil3.
  * debian/libnss3-1d.symbols: Update symbols file with new symbols. Note that
    SEC_StringToOID disappeared (well, was moved to nssutil), compared to
    version 3.12.0~1.9b1, but it was a new symbol, and isn't used anywhere.
  * debian/nss.pc.in, debian/nss-config.in: Add libnssutil3 support.
  * debian/rules:
    + Bumped shlibs.
    + Don't generate libsoftokn3.so.0d.
  * debian/control:
    + Remove transitional libnss3-0d package.
    + Bumped Standards-Version to 3.7.3.0. No changes needed.
    + Build depend on libnspr4-dev >= 4.7.0 (we *do* need the RTM version, and
      not the preceding betas)
  * debian/libnss3-0d.*: Removed.
  * debian/patches/85_security_load.dpatch: Load files from $ORIGIN/nss before
    those of $ORIGIN. Closes: #469079.
  * debian/patches/38_hurd.dpatch: Fix FTBFS on Hurd because of MAXPATHLEN.
    Closes: #419529.
  * debian/patches/00list: Updated accordingly.

 -- Mike Hommey <glandium@debian.org>  Fri, 07 Mar 2008 21:27:54 +0100

nss (3.12.0~1.9b1-2) unstable; urgency=low

  * debian/control: libnss3-1-dbg needs to conflict with older libnss3-0d-dbg,
    as it overwrites so of its files. Closes: #455875.
  * debian/patches/90_realpath.dpatch: Use realpath() in
    loader_GetOriginalPathname, so that symlinks are properly followed when
    determining where the current library lives.
  * debian/patches/00list: Updated accordingly.
  * debian/patches/85_security_load.dpatch: When the module given by the
    caller contains a directory name, remove it so that the module can be
    properly loaded. Closes: #456296.

 -- Mike Hommey <glandium@debian.org>  Sun, 16 Dec 2007 11:06:03 +0100

nss (3.12.0~1.9b1-1) unstable; urgency=low

  * New upstream snapshot, picked from FIREFOX_3_0b1_RELEASE cvs tag.
  * debian/copyright: Add licensing information about the recently added
    sqlite copy in the source tree.
  * debian/control:
    + Build depend on libsqlite3-dev.
    + Rename all -0d packages to -1d, but keep a transitional -0d package,
      since all libraries are compatible (except for the removed one).
    + Make libnss3-1d conflict with older libnss3-0d.
  * debian/patches/38_kbsd.dpatch, debian/patches/81_sonames.dpatch:
    Adapted to upstream changes.
  * debian/patches/81_sonames.dpatch:
    + Remove SO version from libsoftokn3, now it is not linked against
      anymore, but dlloaded.
    + Remove the hacks to have shlibsign and the signature verification code
      handle the SO version in the file name.
    + Bump SO version to 1d.
  * debian/rules:
    + Add NSS_USE_SYSTEM_SQLITE=1 to the make options.
    + Install libsoftokn3 and the new libnssdbm3 in /usr/lib/nss.
    + Run shlibsign on libsoftokn3 in /usr/lib/nss, without a SO version.
    + For some reason, build-stamp was missing in install-stamp dependencies.
    + Bumped shlibs because of new symbols, and pass -c4 to dpkg-gensymbols,
      so that it fails in all cases where the symbols file is not up to date.
    + Adapt upstream version pattern matching so that the ~1.9b1 part is
      removed.
    + Install .1d libraries in -1d packages.
    + Create a dummy libsoftokn3.so.0d library, installed in the libnss3-0d
      package.
  * debian/libnss3-0d.links:
    + Remove links in /usr/lib/xulrunner. The workaround they were
      implementing is going to be done another way.
    + Add .0d links to .1d libraries.
  * debian/libnss3-dev.links:
    + Don't put a symlink for libsoftokn3.
    + .so files now link to .1d libraries.
  * debian/patches/80_security_build.dpatch: Remove the hack to load libfreebl
    from /usr/lib/nss.
  * debian/patches/85_security_load.dpatch: Load modules from $ORIGIN/nss.
  * debian/patches/10_3.11.7_symbol_fix.dpatch: Fix a symbol version. Stolen
    from bz#325672.
  * debian/patches/00list: Updated accordingly.
  * debian/libnss3-0d.dirs: Renamed to libnss3-1d.dirs.

 -- Mike Hommey <glandium@debian.org>  Sat, 08 Dec 2007 10:53:02 +0100

nss (3.11.7-1) unstable; urgency=low

  * New upstream release, picked from NSS_3_11_7_RTM cvs tag.
  * debian/patches/38_kbsd.dpatch: Also add support for the Hurd.
    Closes: #419529.
  * debian/rules:
    + Don't fail on clean with unpatched ruleset. Closes: #421542.
    + Bumped shlibs because of new symbols.
  * debian/patches/81_sonames.dpatch: Adapted to upstream changes.

 -- Mike Hommey <glandium@debian.org>  Sun, 01 Jul 2007 11:29:06 +0200

nss (3.11.5-3) unstable; urgency=low

  * Upload to unstable.

 -- Mike Hommey <glandium@debian.org>  Mon, 09 Apr 2007 20:37:25 +0200

nss (3.11.5-2) experimental; urgency=low

  * debian/rules:
    + Cleaner way to set the NSPR location.
    + Install libcrmf.a files in libnss3-dev.
    + binary-indep now does nothing.
  * debian/control: Make libnss3-dev an Arch: any package.
  * debian/nss.pc.in:
    + Remove libsoftokn3 from ld libraries.
    + Improvement in directories setting.
  * debian/libnss3-dev.dirs: Create /usr/bin.
  * debian/nss-config.in, debian/rules: Install a nss-config script into
    libnss3-dev.

 -- Mike Hommey <glandium@debian.org>  Tue, 27 Mar 2007 20:41:11 +0200

nss (3.11.5-1) experimental; urgency=low

  * Initial release. (Closes: #416151)

 -- Mike Hommey <glandium@debian.org>  Sun, 25 Mar 2007 23:56:17 +0200
