ODFstudio/odfstudio
2
0
Fork 0
Code Issues Packages Activity

nss: upgrade to release 3.45

Browse Source 
Fixes CVE-2019-11729 CVE-2019-11719 CVE-2019-11727, and the less
important CVE-2018-12384 and CVE-2018-12404 from intermediate releases.

Since NSS 3.44 it's possible to build as static libraries and for iOS;
drop the nss-chromium-nss-static.patch and nss-more-static.patch and
hope that it works.

Drop one hunk from nss.patch that looks fixed upstream.

Change-Id: I7f37ac36f7f8dfd49d0bfb4a6185ca49d4f618a3
Reviewed-on: https://gerrit.libreoffice.org/75344
Tested-by: Jenkins
Reviewed-by: Michael Stahl <Michael.Stahl@cib.de>
This commit is contained in:
Michael Stahl
2019-07-10 14:59:10 +02:00
parent fb52df57ab
commit 6efc8a33f6
6 changed files with 9 additions and 550 deletions
Download Patch File Download Diff File Expand all files Collapse all files
download.lst
+2 -2
View File
@@ -181,8 +181,8 @@ export MYTHES_SHA256SUM := 1e81f395d8c851c3e4e75b568e20fa2fa549354e75ab397f9de4b
export MYTHES_TARBALL := a8c2c5b8f09e7ede322d5c602ff6a4b6-mythes-1.2.4.tar.gz
export NEON_SHA256SUM := db0bd8cdec329b48f53a6f00199c92d5ba40b0f015b153718d1b15d3d967fbca
export NEON_TARBALL := neon-0.30.2.tar.gz
export NSS_SHA256SUM := f271ec73291fa3e4bd4b59109f8035cc3a192fc33886f40ed4f9ee4b31c746e9
export NSS_TARBALL := nss-3.38-with-nspr-4.19.tar.gz
export NSS_SHA256SUM := fae11751100510d26f16a245f0db9a5b3d638ab28ce0bccd50d4314f7e526ba1
export NSS_TARBALL := nss-3.45-with-nspr-4.21.tar.gz
export ODFGEN_SHA256SUM := 2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2
export ODFGEN_VERSION_MICRO := 6
export ODFGEN_TARBALL := libodfgen-0.1.$(ODFGEN_VERSION_MICRO).tar.bz2
external/nss/UnpackedTarball_nss.mk
Vendored
-2
View File
@@ -23,8 +23,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
external/nss/ubsan.patch.0 \
external/nss/clang-cl.patch.0 \
$(if $(filter iOS,$(OS)), \
external/nss/nss-chromium-nss-static.patch \
external/nss/nss-more-static.patch \
external/nss/nss-ios.patch) \
$(if $(filter MSC-INTEL,$(COM)-$(CPUNAME)), \
external/nss/nss.cygwin64.in32bit.patch) \
external/nss/clang-cl.patch.0
Vendored
+7 -7
View File
@@ -15,11 +15,11 @@
--- nspr/pr/include/prbit.h
+++ nspr/pr/include/prbit.h
@@ -14,7 +14,7 @@
** functions.
*/
#if defined(_WIN32) && (_MSC_VER >= 1300) && \
- (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_ARM))
+ (defined(_M_IX86) || defined(_M_AMD64) || defined(_M_ARM)) && !defined __clang__
(defined(_M_IX86) || defined(_M_X64) || defined(_M_ARM) || \
- defined(_M_ARM64))
+ defined(_M_ARM64)) && !defined __clang__
# include <intrin.h>
# pragma intrinsic(_BitScanForward,_BitScanReverse)
__forceinline static int __prBitScanForward32(unsigned int val)
@@ -29,15 +29,15 @@
# define PR_HAVE_BUILTIN_BITSCAN32
-#elif ((__GNUC__ >= 4) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)) && \
+#elif defined __GNUC__ && ((__GNUC__ >= 4) || (__GNUC__ == 3 && __GNUC_MINOR__ >= 4)) && \
(defined(__i386__) || defined(__x86_64__) || defined(__arm__))
(defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \
defined(__aarch64__))
# define pr_bitscan_ctz32(val) __builtin_ctz(val)
# define pr_bitscan_clz32(val) __builtin_clz(val)
@@ -136,7 +136,7 @@
*/
#if defined(_MSC_VER) && (defined(_M_IX86) || defined(_M_AMD64) || \
- defined(_M_X64) || defined(_M_ARM))
+ defined(_M_X64) || defined(_M_ARM)) && !defined __clang__
- defined(_M_X64) || defined(_M_ARM) || defined(_M_ARM64))
+ defined(_M_X64) || defined(_M_ARM) || defined(_M_ARM64)) && !defined __clang__
#include <stdlib.h>
#pragma intrinsic(_rotl, _rotr)
#define PR_ROTATE_LEFT32(a, bits) _rotl(a, bits)
external/nss/nss-chromium-nss-static.patch
Vendored
-487
View File
@@ -1,487 +0,0 @@
Based on http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/nss/patches/nss-static.patch
--- a/a/nss/lib/certhigh/certvfy.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/certhigh/certvfy.c Fri May 31 17:44:06 2013 -0700
@@ -13,9 +13,11 @@
#include "certdb.h"
#include "certi.h"
#include "cryptohi.h"
+#ifndef NSS_DISABLE_LIBPKIX
#include "pkix.h"
/*#include "pkix_sample_modules.h" */
#include "pkix_pl_cert.h"
+#endif /* NSS_DISABLE_LIBPKIX */
#include "nsspki.h"
@@ -24,6 +26,47 @@
#include "pki3hack.h"
#include "base.h"
+#ifdef NSS_DISABLE_LIBPKIX
+SECStatus
+cert_VerifyCertChainPkix(
+ CERTCertificate *cert,
+ PRBool checkSig,
+ SECCertUsage requiredUsage,
+ PRTime time,
+ void *wincx,
+ CERTVerifyLog *log,
+ PRBool *pSigerror,
+ PRBool *pRevoked)
+{
+ PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
+ return SECFailure;
+}
+
+SECStatus
+CERT_SetUsePKIXForValidation(PRBool enable)
+{
+ PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
+ return SECFailure;
+}
+
+PRBool
+CERT_GetUsePKIXForValidation()
+{
+ return PR_FALSE;
+}
+
+SECStatus CERT_PKIXVerifyCert(
+ CERTCertificate *cert,
+ SECCertificateUsage usages,
+ CERTValInParam *paramsIn,
+ CERTValOutParam *paramsOut,
+ void *wincx)
+{
+ PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
+ return SECFailure;
+}
+#endif /* NSS_DISABLE_LIBPKIX */
+
/*
* Check the validity times of a certificate
*/
--- a/a/nss/lib/ckfw/nssck.api Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/ckfw/nssck.api Fri May 31 17:44:06 2013 -0700
@@ -1752,7 +1752,7 @@
}
#endif /* DECLARE_STRICT_CRYPTOKI_NAMES */
-static CK_RV CK_ENTRY
+CK_RV CK_ENTRY
__ADJOIN(MODULE_NAME,C_GetFunctionList)
(
CK_FUNCTION_LIST_PTR_PTR ppFunctionList
@@ -1830,7 +1830,7 @@
__ADJOIN(MODULE_NAME,C_WaitForSlotEvent)
};
-static CK_RV CK_ENTRY
+CK_RV CK_ENTRY
__ADJOIN(MODULE_NAME,C_GetFunctionList)
(
CK_FUNCTION_LIST_PTR_PTR ppFunctionList
@@ -1840,6 +1840,8 @@
return CKR_OK;
}
+#define NSS_STATIC
+#ifndef NSS_STATIC
/* This one is always present */
CK_RV CK_ENTRY
C_GetFunctionList
@@ -1849,6 +1850,7 @@
{
return __ADJOIN(MODULE_NAME,C_GetFunctionList)(ppFunctionList);
}
+#endif
#undef __ADJOIN
--- a/a/nss/lib/freebl/rsa.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/freebl/rsa.c Fri May 31 17:44:06 2013 -0700
@@ -1559,6 +1559,14 @@
RSA_Cleanup();
}
+#define NSS_STATIC
+#ifdef NSS_STATIC
+void
+BL_Unload(void)
+{
+}
+#endif
+
PRBool bl_parentForkedAfterC_Initialize;
/*
--- a/a/nss/lib/freebl/shvfy.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/freebl/shvfy.c Fri May 31 17:44:06 2013 -0700
@@ -273,9 +273,22 @@
return SECSuccess;
}
+/*
+ * Define PSEUDO_FIPS if you can't do FIPS software integrity test (e.g.,
+ * if you're using NSS as static libraries), but want to conform to the
+ * rest of the FIPS requirements.
+ */
+#define NSS_STATIC
+#ifdef NSS_STATIC
+#define PSEUDO_FIPS
+#endif
+
PRBool
BLAPI_SHVerify(const char *name, PRFuncPtr addr)
{
+#ifdef PSEUDO_FIPS
+ return PR_TRUE; /* a lie, hence *pseudo* FIPS */
+#else
PRBool result = PR_FALSE; /* if anything goes wrong,
* the signature does not verify */
/* find our shared library name */
@@ -291,11 +303,15 @@
}
return result;
+#endif /* PSEUDO_FIPS */
}
PRBool
BLAPI_SHVerifyFile(const char *shName)
{
+#ifdef PSEUDO_FIPS
+ return PR_TRUE; /* a lie, hence *pseudo* FIPS */
+#else
char *checkName = NULL;
PRFileDesc *checkFD = NULL;
PRFileDesc *shFD = NULL;
@@ -492,6 +508,7 @@
}
return result;
+#endif /* PSEUDO_FIPS */
}
PRBool
--- a/a/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpcertstore.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/libpkix/pkix_pl_nss/module/pkix_pl_httpcertstore.c Fri May 31 17:44:06 2013 -0700
@@ -201,7 +201,11 @@
typedef SECStatus (*pkix_DecodeCertsFunc)(char *certbuf, int certlen,
CERTImportCertificateFunc f, void *arg);
-
+#define NSS_STATIC
+#ifdef NSS_STATIC
+extern SECStatus CERT_DecodeCertPackage(char* certbuf, int certlen,
+ CERTImportCertificateFunc f, void* arg);
+#endif
struct pkix_DecodeFuncStr {
pkix_DecodeCertsFunc func; /* function pointer to the
@@ -223,6 +226,11 @@
*/
static PRStatus PR_CALLBACK pkix_getDecodeFunction(void)
{
+#ifdef NSS_STATIC
+ pkix_decodeFunc.smimeLib = NULL;
+ pkix_decodeFunc.func = CERT_DecodeCertPackage;
+ return PR_SUCCESS;
+#else
pkix_decodeFunc.smimeLib =
PR_LoadLibrary(SHLIB_PREFIX"smime3."SHLIB_SUFFIX);
if (pkix_decodeFunc.smimeLib == NULL) {
@@ -235,7 +243,7 @@
return PR_FAILURE;
}
return PR_SUCCESS;
-
+#endif
}
/*
--- a/a/nss/lib/nss/nssinit.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/nss/nssinit.c Fri May 31 17:44:06 2013 -0700
@@ -20,9 +20,11 @@
#include "secerr.h"
#include "nssbase.h"
#include "nssutil.h"
+#ifndef NSS_DISABLE_LIBPKIX
#include "pkixt.h"
#include "pkix.h"
#include "pkix_tools.h"
+#endif /* NSS_DISABLE_LIBPKIX */
#include "pki3hack.h"
#include "certi.h"
@@ -530,8 +532,10 @@
PRBool dontFinalizeModules)
{
SECStatus rv = SECFailure;
+#ifndef NSS_DISABLE_LIBPKIX
PKIX_UInt32 actualMinorVersion = 0;
PKIX_Error *pkixError = NULL;
+#endif
PRBool isReallyInitted;
char *configStrings = NULL;
char *configName = NULL;
@@ -685,6 +689,7 @@
pk11sdr_Init();
cert_CreateSubjectKeyIDHashTable();
+#ifndef NSS_DISABLE_LIBPKIX
pkixError = PKIX_Initialize
(PKIX_FALSE, PKIX_MAJOR_VERSION, PKIX_MINOR_VERSION,
PKIX_MINOR_VERSION, &actualMinorVersion, &plContext);
@@ -697,6 +702,7 @@
CERT_SetUsePKIXForValidation(PR_TRUE);
}
}
+#endif /* NSS_DISABLE_LIBPKIX */
}
@@ -1081,7 +1087,9 @@
cert_DestroyLocks();
ShutdownCRLCache();
OCSP_ShutdownGlobal();
+#ifndef NSS_DISABLE_LIBPKIX
PKIX_Shutdown(plContext);
+#endif
SECOID_Shutdown();
status = STAN_Shutdown();
cert_DestroySubjectKeyIDHashTable();
--- a/a/nss/lib/pk11wrap/pk11load.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/pk11wrap/pk11load.c Fri May 31 17:44:06 2013 -0700
@@ -318,6 +318,13 @@
}
}
+#define NSS_STATIC
+#ifdef NSS_STATIC
+extern CK_RV NSC_GetFunctionList(CK_FUNCTION_LIST_PTR *pFunctionList);
+extern CK_RV FC_GetFunctionList(CK_FUNCTION_LIST_PTR *pFunctionList);
+extern char **NSC_ModuleDBFunc(unsigned long function,char *parameters, void *args);
+extern CK_RV builtinsC_GetFunctionList(CK_FUNCTION_LIST_PTR *pFunctionList);
+#else
static const char* my_shlib_name =
SHLIB_PREFIX"nss"SHLIB_VERSION"."SHLIB_SUFFIX;
static const char* softoken_shlib_name =
@@ -326,12 +332,14 @@
static PRCallOnceType loadSoftokenOnce;
static PRLibrary* softokenLib;
static PRInt32 softokenLoadCount;
+#endif /* NSS_STATIC */
#include "prio.h"
#include "prprf.h"
#include <stdio.h>
#include "prsystem.h"
+#ifndef NSS_STATIC
/* This function must be run only once. */
/* determine if hybrid platform, then actually load the DSO. */
static PRStatus
@@ -348,6 +356,7 @@
}
return PR_FAILURE;
}
+#endif /* !NSS_STATIC */
/*
* load a new module into our address space and initialize it.
@@ -366,6 +375,16 @@
/* intenal modules get loaded from their internal list */
if (mod->internal && (mod->dllName == NULL)) {
+#ifdef NSS_STATIC
+ if (mod->isFIPS) {
+ entry = FC_GetFunctionList;
+ } else {
+ entry = NSC_GetFunctionList;
+ }
+ if (mod->isModuleDB) {
+ mod->moduleDBFunc = NSC_ModuleDBFunc;
+ }
+#else
/*
* Loads softoken as a dynamic library,
* even though the rest of NSS assumes this as the "internal" module.
@@ -391,6 +410,7 @@
mod->moduleDBFunc = (CK_C_GetFunctionList)
PR_FindSymbol(softokenLib, "NSC_ModuleDBFunc");
}
+#endif
if (mod->moduleDBOnly) {
mod->loaded = PR_TRUE;
@@ -401,6 +421,15 @@
if (mod->dllName == NULL) {
return SECFailure;
}
+#if defined(NSS_STATIC) && !defined(NSS_DISABLE_ROOT_CERTS)
+ if (strstr(mod->dllName, "nssckbi") != NULL) {
+ mod->library = NULL;
+ PORT_Assert(!mod->moduleDBOnly);
+ entry = builtinsC_GetFunctionList;
+ PORT_Assert(!mod->isModuleDB);
+ goto library_loaded;
+ }
+#endif
/* load the library. If this succeeds, then we have to remember to
* unload the library if anything goes wrong from here on out...
@@ -423,6 +452,9 @@
mod->moduleDBFunc = (void *)
PR_FindSymbol(library, "NSS_ReturnModuleSpecData");
}
+#if defined(NSS_STATIC) && !defined(NSS_DISABLE_ROOT_CERTS)
+library_loaded:
+#endif
if (mod->moduleDBFunc == NULL) mod->isModuleDB = PR_FALSE;
if (entry == NULL) {
if (mod->isModuleDB) {
@@ -562,6 +594,7 @@
* if not, we should change this to SECFailure and move it above the
* mod->loaded = PR_FALSE; */
if (mod->internal && (mod->dllName == NULL)) {
+#ifndef NSS_STATIC
if (0 == PR_ATOMIC_DECREMENT(&softokenLoadCount)) {
if (softokenLib) {
disableUnload = PR_GetEnv("NSS_DISABLE_UNLOAD");
@@ -573,12 +606,18 @@
}
loadSoftokenOnce = pristineCallOnce;
}
+#endif
return SECSuccess;
}
library = (PRLibrary *)mod->library;
/* paranoia */
if (library == NULL) {
+#if defined(NSS_STATIC) && !defined(NSS_DISABLE_ROOT_CERTS)
+ if (strstr(mod->dllName, "nssckbi") != NULL) {
+ return SECSuccess;
+ }
+#endif
return SECFailure;
}
--- a/a/nss/lib/softoken/lgglue.c Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/softoken/lgglue.c Fri May 31 17:44:06 2013 -0700
@@ -23,6 +23,8 @@
static LGAddSecmodFunc legacy_glue_addSecmod = NULL;
static LGShutdownFunc legacy_glue_shutdown = NULL;
+#define NSS_STATIC
+#ifndef NSS_STATIC
/*
* The following 3 functions duplicate the work done by bl_LoadLibrary.
* We should make bl_LoadLibrary a global and replace the call to
@@ -160,6 +161,7 @@
return lib;
}
+#endif /* STATIC LIBRARIES */
/*
* stub files for legacy db's to be able to encrypt and decrypt
@@ -272,6 +274,21 @@
return SECSuccess;
}
+#ifdef NSS_STATIC
+#ifdef NSS_DISABLE_DBM
+ return SECFailure;
+#else
+ lib = (PRLibrary *) 0x8;
+
+ legacy_glue_open = legacy_Open;
+ legacy_glue_readSecmod = legacy_ReadSecmodDB;
+ legacy_glue_releaseSecmod = legacy_ReleaseSecmodDBData;
+ legacy_glue_deleteSecmod = legacy_DeleteSecmodDB;
+ legacy_glue_addSecmod = legacy_AddSecmodDB;
+ legacy_glue_shutdown = legacy_Shutdown;
+ setCryptFunction = legacy_SetCryptFunctions;
+#endif
+#else
lib = sftkdb_LoadLibrary(LEGACY_LIB_NAME);
if (lib == NULL) {
return SECFailure;
@@ -297,11 +314,14 @@
PR_UnloadLibrary(lib);
return SECFailure;
}
+#endif /* NSS_STATIC */
/* verify the loaded library if we are in FIPS mode */
if (isFIPS) {
if (!BLAPI_SHVerify(LEGACY_LIB_NAME,(PRFuncPtr)legacy_glue_open)) {
+#ifndef NSS_STATIC
PR_UnloadLibrary(lib);
+#endif
return SECFailure;
}
legacy_glue_libCheckSucceeded = PR_TRUE;
@@ -418,10 +438,12 @@
#endif
crv = (*legacy_glue_shutdown)(parentForkedAfterC_Initialize);
}
+#ifndef NSS_STATIC
disableUnload = PR_GetEnv("NSS_DISABLE_UNLOAD");
if (!disableUnload) {
PR_UnloadLibrary(legacy_glue_lib);
}
+#endif
legacy_glue_lib = NULL;
legacy_glue_open = NULL;
legacy_glue_readSecmod = NULL;
--- a/a/nss/lib/softoken/lgglue.h Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/softoken/lgglue.h Fri May 31 17:44:06 2013 -0700
@@ -38,6 +38,25 @@
typedef void (*LGSetForkStateFunc)(PRBool);
typedef void (*LGSetCryptFunc)(LGEncryptFunc, LGDecryptFunc);
+extern CK_RV legacy_Open(const char *dir, const char *certPrefix,
+ const char *keyPrefix,
+ int certVersion, int keyVersion, int flags,
+ SDB **certDB, SDB **keyDB);
+extern char ** legacy_ReadSecmodDB(const char *appName,
+ const char *filename,
+ const char *dbname, char *params, PRBool rw);
+extern SECStatus legacy_ReleaseSecmodDBData(const char *appName,
+ const char *filename,
+ const char *dbname, char **params, PRBool rw);
+extern SECStatus legacy_DeleteSecmodDB(const char *appName,
+ const char *filename,
+ const char *dbname, char *params, PRBool rw);
+extern SECStatus legacy_AddSecmodDB(const char *appName,
+ const char *filename,
+ const char *dbname, char *params, PRBool rw);
+extern SECStatus legacy_Shutdown(PRBool forked);
+extern void legacy_SetCryptFunctions(LGEncryptFunc, LGDecryptFunc);
+
/*
* Softoken Glue Functions
*/
--- a/a/nss/lib/util/secport.h Tue May 28 23:37:46 2013 +0200
+++ a/a/nss/lib/util/secport.h Fri May 31 17:44:06 2013 -0700
@@ -210,6 +210,8 @@
extern int NSS_SecureMemcmp(const void *a, const void *b, size_t n);
+#define NSS_STATIC
+#ifndef NSS_STATIC
/*
* Load a shared library called "newShLibName" in the same directory as
* a shared library that is already loaded, called existingShLibName.
@@ -244,6 +245,7 @@
PORT_LoadLibraryFromOrigin(const char* existingShLibName,
PRFuncPtr staticShLibFunc,
const char *newShLibName);
+#endif /* NSS_STATIC */
SEC_END_PROTOS
external/nss/nss-more-static.patch
Vendored
-39
View File
@@ -1,39 +0,0 @@
--- a/a/nss/lib/freebl/loader.c
+++ a/a/nss/lib/freebl/loader.c
@@ -114,6 +114,7 @@
#include "genload.c"
+extern FREEBLGetVectorFn FREEBL_GetVector;
/* This function must be run only once. */
/* determine if hybrid platform, then actually load the DSO. */
static PRStatus
@@ -136,9 +136,9 @@
return PR_FAILURE;
}
- handle = loader_LoadLibrary(name);
- if (handle) {
- PRFuncPtr address = PR_FindFunctionSymbol(handle, "FREEBL_GetVector");
+ handle = 0;
+ {
+ PRFuncPtr address = FREEBL_GetVector;
if (address) {
FREEBLGetVectorFn *getVector = (FREEBLGetVectorFn *)address;
const FREEBLVector *dsoVector = getVector();
@@ -887,6 +887,7 @@
void
BL_Unload(void)
{
+#if 0
/* This function is not thread-safe, but doesn't need to be, because it is
* only called from functions that are also defined as not thread-safe,
* namely C_Finalize in softoken, and the SSL bypass shutdown callback called
@@ -905,6 +905,7 @@
}
blLib = NULL;
loadFreeBLOnce = pristineCallOnce;
+#endif
}
/* ============== New for 3.003 =============================== */
external/nss/nss.patch
Vendored
-13
View File
@@ -153,16 +153,3 @@
#! gmake
#
# This Source Code Form is subject to the terms of the Mozilla Public
@@ -89,10 +91,10 @@
NSPR_CONFIGURE_ENV = CC=gcc CXX=g++
endif
ifdef CC
-NSPR_CONFIGURE_ENV = CC=$(CC)
+NSPR_CONFIGURE_ENV = CC="$(CC) "
endif
ifdef CCC
-NSPR_CONFIGURE_ENV += CXX=$(CCC)
+NSPR_CONFIGURE_ENV += CXX="$(CCC) "
endif
# Remove -arch definitions. NSPR can't handle that.
NSPR_CONFIGURE_ENV := $(filter-out -arch x86_64,$(NSPR_CONFIGURE_ENV))