Review: jss 5.10.1-1
Package Information
| Description | Network Security Services for Java Network Security Services for Java (JSS) is a Java interface to NSS. It supports most of the security standards and encryption technologies supported by NSS. JSS also provides a pure Java interface for ASN.1 types and BER/DER encoding. |
|---|---|
| Maintainer | Debian FreeIPA Team <pkg-freeipa-devel@alioth-lists.debian.net> |
| Changed By | Timo Aaltonen <tjaalton@debian.org> |
| Sponsor | tjaalton@ubuntu.com |
| Distribution | unstable |
| Architecture | any |
| VCS | git: https://salsa.debian.org/freeipa-team/jss.git (browse) |
| Popcon Installs | 32 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/jss |
| Uploaded | 1 month, 10 days ago |
New Package Report
.changes
| Distribution | unstable |
|---|---|
| Date | Sun, 27 Sep 2026 21:09:49 +0300 |
| Source | jss |
| Version | 5.10.1-1 |
| Changed-By | Timo Aaltonen <tjaalton@debian.org> |
| Architecture | source amd64 |
Changelog
jss (5.10.1-1) unstable; urgency=medium . [ Timo Aaltonen ] * New upstream release. . [ Jarl Gullberg ] * control: Update standards version. * control: Enable libjss-tools. * rules: use pkg-info.mk in gentarball * rules: exclude debian/ from gentarball. * rules: respect nocheck build profile. * rules: update override_dh_auto_configure with new maven+cmake build steps. * rules: add override_dh_auto_clean for new maven+cmake build steps. * rules: use more fault-evident symlink invocations * rules: use standard flags for build and install * rules: move non-installed files to debian/not-installed * use javahelper to correctly install jss.jar. * rules: enable all hardening flags. * rules: remove redundant removal of javadoc directory. * patches: remove upstreamed patch. * patches: add forwarded patch for unguarded access to PQ algorithm code * patches: add forwarded patch for maven artifact versions * control: add missing separator between dependency variables. * control: mark replacement of libtomcatjss-java * copyright: update license and copyright data
.dsc
| Section | java |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | libjss-java deb java optional arch=any libjss-tools deb java optional arch=any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ Upstream-Name: jss Upstream-Contact: Developers <devel@lists.dogtagpki.org> Source: https://github.com/dogtagpki/jss Files: * Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: GPL-2+ or LGPL-2.1+ or MPL-1.1 or MPL-2.0 Files: tools/src/main/native/sslget/sslget.c Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: GPL-2 Files: tools/src/main/native/sslget/getopt.c Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: GPL-2+ or MPL-1.1 Files: base/src/main/java/org/mozilla/jss/* native/src/main/native/org/mozilla/jss/* tools/src/main/native/p12tool/* base/src/test/java/org/mozilla/jss/tests/* examples/src/main/java/examples/pkcs12.java examples/src/main/java/examples/PQGGen.java lib/jss.map Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: MPL-2.0 Files: tools/src/main/native/p7tool/* base/src/main/java/org/mozilla/jss/crypto/SymmetricKeyDeriver.java base/src/main/java/org/mozilla/jss/pkcs11/PK11SymmetricKeyDeriver.java base/src/main/java/org/mozilla/jss/pkix/cmc/BodyPartReference.java base/src/main/java/org/mozilla/jss/pkix/cmc/CMCStatusInfoV2.java base/src/main/java/org/mozilla/jss/pkix/cmc/DecryptedPOP.java base/src/main/java/org/mozilla/jss/pkix/cmc/EncryptedPOP.java base/src/main/java/org/mozilla/jss/pkix/cmc/ExtendedFailInfo.java base/src/main/java/org/mozilla/jss/pkix/cmc/IdentityProofV2.java base/src/main/java/org/mozilla/jss/pkix/cmc/OtherReqMsg.java base/src/main/java/org/mozilla/jss/pkix/cmc/PopLinkWitnessV2.java base/src/main/java/org/mozilla/jss/pkix/cmc/RevokeRequest.java base/src/test/java/org/mozilla/jss/tests/SymKeyDeriving.java native/src/main/native/org/mozilla/jss/asn1/ASN1Util.c Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: GPL-2+ or LGPL-2.1+ or MPL-1.1 Files: tomcat-9.0/src/main/java/org/dogtagpki/jss/tomcat/* tomcat-10.1/src/main/java/org/dogtagpki/jss/tomcat/* tomcat/src/main/java/org/dogtagpki/jss/tomcat/* Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project License: LGPL-2.1+ Files: tomcat-10.1/src/main/java/org/dogtagpki/jss/tomcat/JSSNioEndpoint.java tomcat-10.1/src/main/java/org/dogtagpki/jss/tomcat/JSSSecureNioChannel.java tomcat-9.0/src/main/java/org/dogtagpki/jss/tomcat/JSSNioEndpoint.java tomcat-9.0/src/main/java/org/dogtagpki/jss/tomcat/JSSSecureNioChannel.java Copyright: © 1998 Netscape Communications Corporation © 1998-2008 The Mozilla Project 2017 Red Hat, Inc. License: Apache-2.0 or LGPL-2.1+ Files: symkey/* base/src/main/java/org/mozilla/jss/symkey/* base/src/main/java/org/mozilla/jss/netscape/* base/src/main/java/org/mozilla/jss/provider/javax/crypto/* base/src/main/java/org/mozilla/jss/pkcs11/PK11DSAParams.java Copyright: 2007 Red Hat, Inc. License: GPL-2 Files: base/src/test/java/org/mozilla/jss/tests/EnumerationZeroTest.java Copyright: 2009-2018 Red Hat, Inc. License: GPL-2 Files: base/src/main/java/org/mozilla/jss/crypto/KEMAlgorithm.java base/src/main/java/org/mozilla/jss/provider/javax/crypto/JSSKEMDecapsulatorSpi.java base/src/main/java/org/mozilla/jss/provider/javax/crypto/JSSKEMEncapsulatorSpi.java base/src/main/java/org/mozilla/jss/provider/javax/crypto/JSSKEMSpi.java base/src/test/java/org/mozilla/jss/tests/KeyEncapsulating.java base/src/test/java/org/mozilla/jss/tests/MLKEMKeyWrapping.java native/src/main/native/org/mozilla/jss/provider/javax/crypto/JSSKEMDecapsulatorSpi.c native/src/main/native/org/mozilla/jss/provider/javax/crypto/JSSKEMEncapsulatorSpi.c Dockerfile Copyright: Red Hat, Inc. License: GPL-2+ Files: base/src/main/java/org/mozilla/jss/provider/javax/crypto/JSSTokenKeyManager.java base/src/main/java/org/mozilla/jss/provider/javax/crypto/JSSTrustManager.java Copyright: 2007 Red Hat, Inc. License: LGPL-2.1+ Files: tools/logging.properties Copyright: 2020 Red Hat, Inc. License: Apache-2.0 Files: cmake/FindNSPR.cmake cmake/FindNSS.cmake Copyright: 2006-2010, Andreas Schneider <asn@redhat.com> License: BSD-3-clause Files: cmake/Java.cmake cmake/JavaFileList.cmake Copyright: 2012 Red Hat, Inc. License: GPL-2 Files: jss.spec Copyright: 2012 Red Hat, Inc. License: MPL-1.1 Files: debian/* Copyright: © 2008 Michele Baldessari <michele@acksyn.org> License: LGPL-2.1+ or GPL-2+ or MPL-1.1 License: Apache-2.0 On Debian systems, the complete text of the Apache License version 2 can be found in "/usr/share/common-licenses/Apache-2.0". License: GPL-2+ On Debian systems, the complete text of the GNU General Public License version 2 can be found in "/usr/share/common-licenses/GPL-2". License: GPL-2 On Debian systems, the complete text of the GNU General Public License version 2 can be found in "/usr/share/common-licenses/GPL-2". License: LGPL-2.1+ On Debian systems, the complete text of the GNU Lesser General Public License can be found in "/usr/share/common-licenses/LGPL-2.1". License: MPL-1.1 On Debian systems, the complete text of the Mozilla Public License version 1.1 can be found in "/usr/share/common-licenses/MPL-1.1". License: MPL-2.0 On Debian systems, the complete text of the Mozilla Public License version 2.0 can be found in "/usr/share/common-licenses/MPL-2.0". License: BSD-3-clause Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: . 1. Redistributions of source code must retain the copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. The name of the author may not be used to endorse or promote products derived from this software without specific prior written permission. . THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
Review Information
accepted — allocated to awm 1 month, 9 days ago, started 1 month, 9 days ago, completed 1 month, 9 days ago.
Final Comment
Hi,
Some Minor Packaging issues...
- dh_auto_test runs ctest in the wrong directory (rules:47)
The CMake build is configured/built into build2 (rules:15,39,43), but the test override runs cd build && ctest. The build/ directory is just an empty upstream placeholder (only .gitkeep), so the native test suite never actually runs against the built tree. The trailing || true then silently swallows the failure, so the error is invisible. This should be build2.
Relatedly, override_dh_auto_clean cleans build2 but never the stale build/ dir;
- debian/not-installed glob doesn't match the real install path
The file contains debian/tmp/jss/tests/*, but tests/CMakeLists.txt installs to ${SHARE_INSTALL_PREFIX}/jss/tests/bin (i.e. debian/tmp/usr/share/jss/tests/bin/...). The missing usr/share/ means dh_missing can't suppress those uninstalled test scripts, and it's a confusing/stale entry.
- debian/watch is likely broken
Matching-Pattern: .*/releases/tag/@ANY_VERSION@
Filename-Mangle: s/@ANY_VERSION@$/jss-$1.tar.gz/
The Filename-Mangle references $1, but the Matching-Pattern defines no capture group, so $1 is undefined. Combined with a Source: pointing at an HTML tags page (no downloadable tarball), uscan can't construct/fetch jss-.tar.gz.
Hope this is helpful!