internal/rosa/package: migrate nss

Signed-off-by: Ophestra <cat@gensokyo.uk>

internal/rosa/package/nss.az

@@ -0,0 +1,99 @@
+package nspr {
+	description = "nspr source tree";
+	anitya = 7953;
+	exclude = true;
+
+	version* = "4.38.2";
+	output = remoteTar {
+		url = "https://ftp.mozilla.org/pub/nspr/releases/v"+version+
+			"/src/nspr-"+version+".tar.gz";
+		checksum = "BcKpVmN6bdBaoZyzht_SpGHnO1CRN5YHeVyWW2skfCKIdhy3ppKe1zMh85QBEsV_";
+		compress = gzip;
+	};
+}
+
+package nss {
+	description = "Network Security Services";
+	website = "https://firefox-source-docs.mozilla.org/security/nss/index.html";
+	anitya = 2503;
+
+	version* = "3.123.1";
+	source = remoteGitHub {
+		suffix = "nss-dev/nss";
+		tag = "NSS_"+join {
+			elems = split {
+				s = version;
+				sep = ".";
+				n = 3;
+			};
+			sep = "_";
+		}+"_RTM";
+		checksum = "g811Z_fc74ssg-s6BeXRG-ipSfJggD6hrxjVJxrOBIz98CE7piv0OLwzIRLMQpwR";
+	};
+	extra = [ nspr ];
+
+	enterSource = true;
+	writable = true;
+	chmod = true;
+	early = "\nln -s extra/nspr/nspr /usr/src/nspr\n";
+
+	exec = make {
+		omitDefaults = true;
+		skipConfigure = true;
+		inPlace = true;
+
+		make = [
+			"CCC=clang++",
+			"NSDISTMODE=copy",
+			"BUILD_OPT=1",
+			"USE_64=1",
+			"nss_build_all",
+		];
+		skipCheck = true;
+		install = `
+cp -r \
+	/usr/src/dist/. \
+	lib/ckfw/builtins/certdata.txt \
+	/work/
+`;
+	};
+
+	inputs = [
+		perl,
+		python,
+		gawk,
+		coreutils,
+
+		zlib,
+		kernel-headers,
+	];
+
+	runtime = [ zlib ];
+}
+
+package nss-cacert {
+	description = "bundle of X.509 certificates of public Certificate Authorities";
+	website = "https://curl.se/docs/caextract.html";
+	version = unversioned;
+
+	source = nss;
+
+	exec = generic {
+		build = `
+mkdir -p /work/system/etc/ssl/{certs/unbundled,certs/hashed,trust-source}
+buildcatrust \
+	--certdata_input certdata.txt \
+	--ca_bundle_output /work/system/etc/ssl/certs/ca-bundle.crt \
+	--ca_standard_bundle_output /work/system/etc/ssl/certs/ca-no-trust-rules-bundle.crt \
+	--ca_unpacked_output /work/system/etc/ssl/certs/unbundled \
+	--ca_hashed_unpacked_output /work/system/etc/ssl/certs/hashed \
+	--p11kit_output /work/system/etc/ssl/trust-source/ca-bundle.trust.p11-kit
+`;
+	};
+
+	inputs = [
+		bash,
+
+		buildcatrust,
+	];
+}