Add nss.fips.cfg support to OpenJDK tree (#22)

Reviewed-by: @martinuy

Author: gnu-andrew

make/autoconf/build-aux/pkg.m4

@@ -179,3 +179,19 @@ else
 	ifelse([$3], , :, [$3])
 fi[]dnl
 ])# PKG_CHECK_MODULES
+
+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
+dnl -------------------------------------------
+dnl Since: 0.28
+dnl
+dnl Retrieves the value of the pkg-config variable for the given module.
+AC_DEFUN([PKG_CHECK_VAR],
+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
+
+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
+AS_VAR_COPY([$1], [pkg_cv_][$1])
+
+AS_VAR_IF([$1], [""], [$5], [$4])dnl
+])dnl PKG_CHECK_VAR

make/autoconf/lib-sysconf.m4

@@ -32,8 +32,10 @@ AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
   #
   # Check for the NSS library
   #
+  AC_MSG_CHECKING([for NSS library directory])
+  PKG_CHECK_VAR(NSS_LIBDIR, nss, libdir, [AC_MSG_RESULT([$NSS_LIBDIR])], [AC_MSG_RESULT([not found])])
 
-  AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)])
+  AC_MSG_CHECKING([whether to link the system NSS library with the System Configurator (libsysconf)])
 
   # default is not available
   DEFAULT_SYSCONF_NSS=no
@@ -81,4 +83,5 @@ AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
       fi
   fi
   AC_SUBST(USE_SYSCONF_NSS)
+  AC_SUBST(NSS_LIBDIR)
 ])

make/autoconf/spec.gmk.in

@@ -870,6 +870,7 @@ INSTALL_SYSCONFDIR=@sysconfdir@
 USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
 NSS_LIBS:=@NSS_LIBS@
 NSS_CFLAGS:=@NSS_CFLAGS@
+NSS_LIBDIR:=@NSS_LIBDIR@
 
 USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
 LCMS_CFLAGS:=@LCMS_CFLAGS@

make/modules/java.base/Gendata.gmk

@@ -98,3 +98,17 @@ $(GENDATA_JAVA_SECURITY): $(BUILD_TOOLS_JDK) $(GENDATA_JAVA_SECURITY_SRC) $(REST
 TARGETS += $(GENDATA_JAVA_SECURITY)
 
 ################################################################################
+
+GENDATA_NSS_FIPS_CFG_SRC := $(TOPDIR)/src/java.base/share/conf/security/nss.fips.cfg.in
+GENDATA_NSS_FIPS_CFG := $(SUPPORT_OUTPUTDIR)/modules_conf/java.base/security/nss.fips.cfg
+
+$(GENDATA_NSS_FIPS_CFG): $(GENDATA_NSS_FIPS_CFG_SRC)
+	$(call LogInfo, Generating nss.fips.cfg)
+	$(call MakeTargetDir)
+	$(call ExecuteWithLog, $(SUPPORT_OUTPUTDIR)/gensrc/java.base/_$(@F), \
+	    ( $(SED) -e 's:@NSS_LIBDIR@:$(NSS_LIBDIR):g' $< ) > $@ \
+	)
+
+TARGETS += $(GENDATA_NSS_FIPS_CFG)
+
+################################################################################

src/java.base/share/conf/security/nss.fips.cfg.in

@@ -0,0 +1,8 @@
+name = NSS-FIPS
+nssLibraryDirectory = @NSS_LIBDIR@
+nssSecmodDirectory = sql:/etc/pki/nssdb
+nssDbMode = readOnly
+nssModule = fips
+
+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
+