OpenJDK includes the OASIS PKCS#11 headers in
src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11*.h. It is
unclear whether OASIS IPR is DFSG-free (see #952951). Most probably it
is not:
https://enterprise.dejacode.com/licenses/public/oasis-ipr-policy-2014/

libnss3-dev contains MPL-2.0 licensed drop-in replacements for the
headers, which is already a build dependency and might be used instead.

setting the priority back, as the bug submitter has chosen.  Note this also
applies to openjdk-11.

This is incomplete, just a mechanical patch.

Replace header files in src/jdk.crypto.cryptoki/share/native/libj2pkcs11.

Import from NSPR 4.29:
 - prcpucfg.h
 - prtypes.h

Import from NSS 2.63:
 - pkcs11.h
 - pkcs11f.h
 - pkcs11n.h
 - pkcs11p.h
 - pkcs11t.h
 - pkcs11u.h

src/jdk.crypto.cryptoki/unix/native/libj2pkcs11/p11_md.h:
 - Remove macro CK_PTR
 - Remove macro CK_DEFINE_FUNCTION
 - Remove macro CK_DECLARE_FUNCTION
 - Remove macro CK_DECLARE_FUNCTION_POINTER
 - Remove macro CK_CALLBACK_FUNCTION

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h:
 - use CK_TRUE/CK_FALSE instead of TRUE/FALSE

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c:
 - FIXME: CKM_KEA_DERIVE is undefined

src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c:
 - FIXME: CKM_CAMELLIA_CTR is undefined

Control: forwarded -1 https://bugzilla.mozilla.org/show_bug.cgi?id=1792499

The PKCS#11 standard is ambiguous about this name.

This is not supported by NSS currently.
I have forwarded this bug to the upstream request for it.

Am 27.09.22 um 03:13 schrieb Bastian Germann:

It is present in both OASIS and NSS headers as CKM_KEA_KEY_DERIVE.

Hi DFSG Team,

I would like to have a decision on this longstanding bug.
The OASIS license is found in other packages which are still in
unstable/testing.

Thank you,
Bastian