[rpms/nss] f44: Update NSS to 3.127.0

[Frantisek Krenzelok <fkrenzel@redhat.com>]

A new commit has been pushed.

Repo   : rpms/nss
Branch : f44
Commit : 85aa0c02465ccd4e2bb81e38e7e990404aa0e83a
Author : Frantisek Krenzelok <fkrenzel@redhat.com>
Date   : 2026-08-28T14:35:10+02:00
Stats  : +20/-3 in 3 file(s)
URL    : https://src.fedoraproject.org/rpms/nss/c/85aa0c02465ccd4e2bb81e38e7e990404aa0e83a?branch=f44

Log:
Update NSS to 3.127.0

---
diff --git a/nss-3.127-disable-dtls13-clientcert-test.patch b/nss-3.127-disable-dtls13-clientcert-test.patch
new file mode 100644
index 0000000..f7d3d3e
--- /dev/null
+++ b/nss-3.127-disable-dtls13-clientcert-test.patch
@@ -0,0 +1,12 @@
+--- a/gtests/ssl_gtest/ssl_auth_unittest.cc
++++ b/gtests/ssl_gtest/ssl_auth_unittest.cc
+@@ -465,6 +465,9 @@
+ // DTLS variant: Finished is its own record, so SplitServerFinished drops it
+ // entirely (finished_start == 0) and saves it for injection via Inject().
+ TEST_F(TlsConnectDatagram13, ClientCertCallbackBeforeServerFinished) {
++  // SplitServerFinished Protect() call advances the DTLS sequence counter,
++  // causing SSL_ERROR_RX_MALFORMED_HANDSHAKE (upstream test infra bug).
++  GTEST_SKIP();
+   client_->SetupClientAuth(ClientAuthCallbackType::kAsyncDelay, true);
+   server_->RequestClientAuth(true);
+   auto split = MakeTlsFilter<SplitServerFinished>(server_);

diff --git a/nss.spec b/nss.spec
index 2c2a2b4..724ffb4 100644
--- a/nss.spec
+++ b/nss.spec
@@ -1,5 +1,5 @@
 %global nspr_version 4.39.0
-%global nss_version 3.126.0
+%global nss_version 3.127.0
 # NOTE: To avoid NVR clashes of nspr* packages:
 # - reset %%{nspr_release} to 1, when updating %%{nspr_version}
 # - increment %%{nspr_version}, when updating the NSS part only
@@ -7,7 +7,7 @@
 %global nss_release %baserelease
 # use "%%global nspr_release %%[%%baserelease+n]" to handle offsets when
 # release number between nss and nspr are different.
-%global nspr_release %[%baserelease+2]
+%global nspr_release %[%baserelease+3]
 # only need to update this as we added new
 # algorithms under nss policy control
 %global crypto_policies_version 20240521
@@ -151,6 +151,7 @@ Patch70:          nss-3.125-drbg-reseed-after-fork.patch
 
 Patch100:         nspr-config-pc.patch
 Patch101:         nspr-gcc-atomics.patch
+Patch71:           nss-3.127-disable-dtls13-clientcert-test.patch
 
 %description
 Network Security Services (NSS) is a set of libraries designed to
@@ -1097,6 +1098,10 @@ fi
 
 
 %changelog
+* Fri Aug 28 2026 Frantisek Krenzelok <fkrenzel@redhat.com> - 3.127.0-1
+- Update NSS to 3.127.0
+- DisableTlsConnectDatagram13.ClientCertCallbackBeforeServerFinished
+
 * Thu Jul 30 2026 Frantisek Krenzelok <fkrenzel@redhat.com> - 3.126.0-1
 - Update NSS to 3.126.0
 

diff --git a/sources b/sources
index 3c9b9c6..2eec8fb 100644
--- a/sources
+++ b/sources
@@ -1,4 +1,4 @@
 SHA512 (blank-cert9.db) = 2f8eab4c0612210ee47db8a3a80c1b58a0b43849551af78c7da403fda3e3d4e7757838061ae56ccf5aac335cb54f254f0a9e6e9c0dd5920b4155a39264525b06
 SHA512 (blank-key4.db) = 8fedae93af7163da23fe9492ea8e785a44c291604fa98e58438448efb69c85d3253fc22b926d5c3209c62e58a86038fd4d78a1c4c068bc00600a7f3e5382ebe7
 SHA512 (nss-3.118-ml-dsa-test-for-sign-verify-pkcs12_files.tar.xz) = c6440f332703ca9a3351be5a35eac42f24b9c114f54137b95691aa353cc329f0fb7016b689b2f976bc6cff66aa62760067f3226efad665a5252f37294a3d12a6
-SHA512 (nss-3.126-with-nspr-4.39.tar.gz) = 521f5dd5e09d66f0bd946e0ea90502d7bf4de4f26d67f993c0dc82c881b3f5758a218bd58941d2423a729342bc8d73d404c8fb92f0d0bb7d136095954641a860
+SHA512 (nss-3.127-with-nspr-4.39.tar.gz) = 97bf752f6dd8dacdfde239112aada46e08baa95134bbc93deb0663d8dcd06cff9fa6cbfbd9c2344c7b7c99d78067797e8c07ada35aff8aefd2091223066df47e