re-introduce old nss im too tired for this

security/nss/automation/taskcluster/scripts/build_gyp.sh

@@ -12,7 +12,7 @@ if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
 fi
 
 # Build.
-nss/build.sh -g -v --enable-libpkix -Denable_draft_hpke=1 "$@"
+nss/build.sh -g -v --enable-libpkix "$@"
 
 # Package.
 if [[ $(uname) = "Darwin" ]]; then

security/nss/automation/taskcluster/scripts/build_image.sh

@@ -18,10 +18,7 @@ CONTEXT_PATH="/home/worker/nss/$CONTEXT_PATH"
 test -d "$CONTEXT_PATH" || raise_error "Context Path $CONTEXT_PATH does not exist."
 test -f "$CONTEXT_PATH/Dockerfile" || raise_error "Dockerfile must be present in $CONTEXT_PATH."
 
-apt-get update
-apt-get -y install zstd
-
 docker build -t "$PROJECT:$HASH" "$CONTEXT_PATH"
 
 mkdir /artifacts
-docker save "$PROJECT:$HASH" | zstd > /artifacts/image.tar.zst
+docker save "$PROJECT:$HASH" > /artifacts/image.tar

security/nss/automation/taskcluster/scripts/check_abi.sh

@@ -89,7 +89,7 @@ check_abi()
   abi_diff
 }
 
-#Slightly modified from build.sh in this directory
+#Slightly modified from builbot-slave/build.sh
 abi_diff()
 {
   ABI_PROBLEM_FOUND=0
@@ -97,8 +97,7 @@ abi_diff()
   rm -f ${ABI_REPORT}
   PREVDIST=${HGDIR}/baseline/dist
   NEWDIST=${HGDIR}/dist
-  # libnssdbm3.so isn't built by default anymore, skip it.
-  ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
+  ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnssdbm3.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
   for SO in ${ALL_SOs}; do
       if [ ! -f ${HGDIR}/nss/automation/abi-check/expected-report-$SO.txt ]; then
           touch ${HGDIR}/nss/automation/abi-check/expected-report-$SO.txt
@@ -123,7 +122,7 @@ abi_diff()
       # If abidiff reports an error, or a usage error, or if it sets a result
       # bit value this script doesn't know yet about, we'll report failure.
       # For ABI changes, we don't yet report an error. We'll compare the
-      # result report with our allowlist. This allows us to silence changes
+      # result report with our whitelist. This allows us to silence changes
       # that we're already aware of and have been declared acceptable.
 
       REPORT_RET_AS_FAILURE=0
@@ -141,10 +140,10 @@ abi_diff()
       fi
 
       if [ $ABIDIFF_ABI_CHANGE -ne 0 ]; then
-          echo "Ignoring abidiff result ABI_CHANGE, instead we'll check for non-allowlisted differences."
+          echo "Ignoring abidiff result ABI_CHANGE, instead we'll check for non-whitelisted differences."
       fi
       if [ $ABIDIFF_ABI_INCOMPATIBLE_CHANGE -ne 0 ]; then
-          echo "Ignoring abidiff result ABIDIFF_ABI_INCOMPATIBLE_CHANGE, instead we'll check for non-allowlisted differences."
+          echo "Ignoring abidiff result ABIDIFF_ABI_INCOMPATIBLE_CHANGE, instead we'll check for non-whitelisted differences."
       fi
 
       if [ $REPORT_RET_AS_FAILURE -ne 0 ]; then

security/nss/automation/taskcluster/scripts/run_coverity.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+source $(dirname "$0")/tools.sh
+
+# Clone NSPR if needed.
+if [ ! -d "nspr" ]; then
+    hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
+
+  if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
+    pushd nspr
+    cat ../nss/nspr.patch | patch -p1
+    popd
+  fi
+fi
+
+# Build and run Coverity
+cd nss
+./mach static-analysis
+
+# Return the exit code of the Coverity Analysis
+exit $?

security/nss/automation/taskcluster/scripts/run_hacl.sh

@@ -8,37 +8,33 @@ fi
 
 set -e -x -v
 
-# The docker image this is running in has NSS sources.
-# Get the HACL* source, containing a snapshot of the C code, extracted on the
-# HACL CI.
-git clone -q "https://github.com/hacl-star/hacl-star" ~/hacl-star
-git -C ~/hacl-star checkout -q 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6
+# The docker image this is running in has the HACL* and NSS sources.
+# The extracted C code from HACL* is already generated and the HACL* tests were
+# successfully executed.
 
-# Format the C snapshot.
-cd ~/hacl-star/dist/mozilla
-cp ~/nss/.clang-format .
-find . -type f -name '*.[ch]' -exec clang-format -i {} \+
-cd ~/hacl-star/dist/karamel
+# Verify HACL*. Taskcluster fails when we do this in the image build.
+make -C hacl-star verify-nss -j$(nproc)
+
+# Add license header to specs
+spec_files=($(find ~/hacl-star/specs -type f -name '*.fst'))
+for f in "${spec_files[@]}"; do
+    cat /tmp/license.txt "$f" > /tmp/tmpfile && mv /tmp/tmpfile "$f"
+done
+
+# Format the extracted C code.
+cd ~/hacl-star/snapshots/nss
 cp ~/nss/.clang-format .
 find . -type f -name '*.[ch]' -exec clang-format -i {} \+
 
 # These diff commands will return 1 if there are differences and stop the script.
-
-# We have two checks in the script. 
-# The first one only checks the files in the verified/internal folder; the second one does for all the rest
-# It was implemented like this due to not uniqueness of the names in the verified folders
-# For instance, the files Hacl_Chacha20.h are present in both directories, but the content differs.
-
-files=($(find ~/nss/lib/freebl/verified/internal -type f -name '*.[ch]'))
+files=($(find ~/nss/lib/freebl/verified/ -type f -name '*.[ch]'))
 for f in "${files[@]}"; do
-    file_name=$(basename "$f")
-    hacl_file=($(find ~/hacl-star/dist/mozilla/internal/ -type f -name $file_name))
-    diff $hacl_file $f
+    diff $f $(basename "$f")
 done
 
-files=($(find ~/nss/lib/freebl/verified/ -type f -name '*.[ch]' -not -path "*/freebl/verified/internal/*" -not -path "*/freebl/verified/config.h"))
+# Check that the specs didn't change either.
+cd ~/hacl-star/specs
+files=($(find ~/nss/lib/freebl/verified/specs -type f))
 for f in "${files[@]}"; do
-    file_name=$(basename "$f")
-    hacl_file=($(find ~/hacl-star/dist/mozilla/ ~/hacl-star/dist/karamel/ -type f -name $file_name -not -path "*/hacl-star/dist/mozilla/internal/*"))
-    diff $hacl_file $f
+    diff $f $(basename "$f")
 done

security/nss/automation/taskcluster/scripts/run_saw.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+source $(dirname "$0")/tools.sh
+
+# Fetch artifact if needed.
+fetch_dist
+
+# Run SAW.
+saw "nss/automation/saw/$1.saw"

security/nss/automation/taskcluster/scripts/split.sh

@@ -39,6 +39,7 @@ split_util() {
   # Copy some files at the top and the util subdirectory recursively.
   mkdir $dstdir/lib
   cp $nssdir/lib/Makefile $dstdir/lib
+  cp $nssdir/lib/manifest.mn $dstdir/lib
   cp -R $nssdir/lib/util $dstdir/lib/util
 }