[rpms/nss] rawhide: Work around GNU patch 2.8 --fuzz=0 bug for tools.sh call-site

[rpms/nss] rawhide: Work around GNU patch 2.8 --fuzz=0 bug for tools.sh call-site

[@ 2026-08-21 11:21 UTC (permalink / raw)]

            A new commit has been pushed.

            Repo   : rpms/nss
            Branch : rawhide
            Commit : d7d75094bfc852ecee4c401eb453b796a9d0fc52
            Author : Krenželok František <fkrenzel@redhat.com>
            Date   : 2026-08-21T13:12:15+02:00
            Stats  : +14/-9 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/nss/c/d7d75094bfc852ecee4c401eb453b796a9d0fc52?branch=rawhide

            Log:
            Work around GNU patch 2.8 --fuzz=0 bug for tools.sh call-site

The tools_p12_ml_dsa_import call-site addition in
nss-3.118-ml-dsa-test-for-sign-verify-pkcs12.patch cannot be applied
with --fuzz=0 even though all 7 context lines match byte-for-byte.
GNU patch 2.8 requires fuzz=1 due to cumulative hunk offset tracking.

Split the call-site hunk out of the patch and replace it with a sed
command in %prep, which sidesteps the --fuzz=0 limitation entirely.

---
diff --git a/nss-3.118-ml-dsa-test-call-site.patch b/nss-3.118-ml-dsa-test-call-site.patch
new file mode 100644
index 0000000..5143956
--- /dev/null
+++ b/nss-3.118-ml-dsa-test-call-site.patch
@@ -0,0 +1,11 @@
+--- a/tests/tools/tools.sh
++++ b/tests/tools/tools.sh
+@@ -664,7 +664,8 @@
+   tools_p12_export_with_invalid_ciphers
+   tools_p12_import_old_files
+   tools_p12_import_pbmac1_samples
+   tools_p12_import_ed25519_private_key
++  tools_p12_ml_dsa_import
+   tools_p12_ml_kem_import
+   if using_sql; then
+     tools_p12_import_rsa_pss_private_key

diff --git a/nss-3.118-ml-dsa-test-for-sign-verify-pkcs12.patch b/nss-3.118-ml-dsa-test-for-sign-verify-pkcs12.patch
index 8a3afad..e4307fd 100644
--- a/nss-3.118-ml-dsa-test-for-sign-verify-pkcs12.patch
+++ b/nss-3.118-ml-dsa-test-for-sign-verify-pkcs12.patch
@@ -471,12 +471,3 @@ diff --git a/tests/tools/tools.sh b/tests/tools/tools.sh
  tools_p12_ml_kem_import()
  {
    echo "$SCRIPTNAME: Testing ml-kem compatibility with pkcs12 --------------"
-@@ -616,7 +652,8 @@
-   tools_p12_export_with_invalid_ciphers
-   tools_p12_import_old_files
-   tools_p12_import_pbmac1_samples
-   tools_p12_import_ed25519_private_key
-+  tools_p12_ml_dsa_import
-   tools_p12_ml_kem_import
-   if using_sql; then
-     tools_p12_import_rsa_pss_private_key

diff --git a/nss.spec b/nss.spec
index 670c3de..4f669bb 100644
--- a/nss.spec
+++ b/nss.spec
@@ -343,6 +343,9 @@ popd
 
 pushd nss
 %autopatch -p1 -M 99
+# GNU patch 2.8 --fuzz=0 cannot apply this one-line call-site addition due to
+# cumulative hunk offset interaction; use sed as a workaround
+sed -i 's/^  tools_p12_import_ed25519_private_key$/&\n  tools_p12_ml_dsa_import/' tests/tools/tools.sh
 popd
 
 tar -xf %{SOURCE30}