Bug 688015

Summary: Spec file does not indicate provenance of "stripped" source tarball
Product: [Fedora] Fedora Reporter: Matt McCutchen <matt>
Component: nssAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: emaldona, kdudka, kengert, rrelyea
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: nss-3.12.10-6.fc16 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-11 22:57:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Matt McCutchen 2011-03-16 03:06:54 UTC 
Description of problem:
As per https://fedoraproject.org/wiki/Packaging:SourceURL , the "Source0" field
in the spec file must either give the full URL or have a comment stating how to
obtain or generate the tarball.

Version-Release number of selected component (if applicable):
https://pkgs.fedoraproject.org/gitweb/?p=nss.git;a=blob;f=nss.spec;h=a92f5956228da948642f80196cd73fb0e031ce50;hb=HEAD
Comment 1 Elio Maldonado Batiz 2011-07-24 03:38:55 UTC 
Based on the guidelines and having seen what Openssl does, I think the following changes to the spec file

Source0:          %{name}-%{version}-stripped.tar.bz2
# The stripped tar ball is a subset of the upstream sources with
# patent-encumbered cryptographic algorithms removed.
# Use this script to remove them and create the stripped archive.
# 1. Download the sources nss-{version}.tar.gz found within 
# http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/
# in a subdirectory named NSS_${major}_${minor}_${maint}_RTM/src
# 2. In the download directory execute
# ./mozilla-crypto-strip.sh ${name}-${version}.tar.gz
# to produce ${name}-${version}-stripped.tar.bz2
# for uploading to the lookaside cache.
Source100:        mozilla-crypto-strip.sh

should take care of it.