security/dogtag-jss: Add new Port

Java Security Services provides a Java interface to Mozilla NSS.
It includes a Java security provider and native JNI libraries for
cryptographic operations, certificate handling, and symmetric-key
operations used by Dogtag PKI.

WWW: https://github.com/dogtagpki/jss

Sponsored by:	Netzkommune GmbH

Required for: FreeIPA server port

8 files changed, 216 insertions, 0 deletions

diff --git a/security/Makefile b/security/Makefile
index fc9cd64fc010..56d8e3bfde86 100644
--- a/security/Makefile
+++ b/security/Makefile
@@ -145,6 +145,7 @@
     SUBDIR += distcache
     SUBDIR += diswall
     SUBDIR += doas
+    SUBDIR += dogtag-jss
     SUBDIR += dogtag-pki
     SUBDIR += dotdotpwn
     SUBDIR += dropbear
diff --git a/security/dogtag-jss/Makefile b/security/dogtag-jss/Makefile
new file mode 100644
index 000000000000..dc9d9c5d122d
--- /dev/null
+++ b/security/dogtag-jss/Makefile
@@ -0,0 +1,76 @@
+PORTNAME=	dogtag-jss
+DISTVERSIONPREFIX=	v
+DISTVERSION=	5.7.0
+CATEGORIES=	security java
+
+MAINTAINER=	joneum@FreeBSD.org
+COMMENT=	Java security services using Mozilla NSS
+WWW=		https://github.com/dogtagpki/jss
+
+LICENSE=	APACHE20 MPL11
+LICENSE_COMB=	multi
+LICENSE_FILE_APACHE20=	${WRKSRC}/symkey/LICENSE
+LICENSE_FILE_MPL11=	${WRKSRC}/MPL-1.1.txt
+
+BUILD_DEPENDS=	${JAVAJARDIR}/commons-lang3.jar:java/apache-commons-lang3 \
+		${JAVAJARDIR}/slf4j-api.jar:devel/slf4j \
+		${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar:devel/slf4j \
+		${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar:www/tomcat9 \
+		bash:shells/bash \
+		zip:archivers/zip
+
+LIB_DEPENDS=	libnspr4.so:devel/nspr \
+		libnss3.so:security/nss
+
+RUN_DEPENDS=	${JAVAJARDIR}/commons-lang3.jar:java/apache-commons-lang3 \
+		${JAVAJARDIR}/slf4j-api.jar:devel/slf4j \
+		${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar:devel/slf4j \
+		${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar:www/tomcat9
+
+USES=		cmake compiler:c++11-lang java:build,run pkgconfig shebangfix
+USE_GITHUB=	yes
+GH_ACCOUNT=	dogtagpki
+GH_PROJECT=	jss
+JAVA_VERSION=	17
+USE_LDCONFIG=	yes
+
+SHEBANG_FILES=	tools/reproducible_jar.sh
+
+CMAKE_ARGS=	-DJAVA_HOME=${JAVA_HOME} \
+		-DJNI_DIR=${JAVAJARDIR} \
+		-DLANG_JAR=${JAVAJARDIR}/commons-lang3.jar \
+		-DLIB_DIR=${PREFIX}/lib \
+		-DSLF4J_API_JAR=${JAVAJARDIR}/slf4j-api.jar \
+		-DSLF4J_JDK14_JAR=${JAVASHAREDIR}/slf4j/slf4j-jdk14.jar \
+		-DTOMCAT_CATALINA_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/catalina.jar \
+		-DTOMCAT_COYOTE_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-coyote.jar \
+		-DTOMCAT_JULI_JAR=${LOCALBASE}/apache-tomcat-9.0/bin/tomcat-juli.jar \
+		-DTOMCAT_UTIL_JAR=${LOCALBASE}/apache-tomcat-9.0/lib/tomcat-util.jar
+CMAKE_OFF=	WITH_JAVADOC WITH_TESTS
+
+ALL_TARGET=	java symkey_library
+LDFLAGS+=	-L${LOCALBASE}/lib -Wl,--undefined-version
+
+PLIST_FILES=	${JAVAJARDIR}/jss-tomcat-9.0.jar \
+		${JAVAJARDIR}/jss-tomcat.jar \
+		${JAVAJARDIR}/jss.jar \
+		lib/libjss-symkey.so \
+		lib/libjss.so
+
+do-install:
+	@${MKDIR} ${STAGEDIR}${JAVAJARDIR}
+	${INSTALL_DATA} ${BUILD_WRKSRC}/jss.jar \
+		${STAGEDIR}${JAVAJARDIR}/jss.jar
+	${INSTALL_DATA} ${BUILD_WRKSRC}/jss-tomcat.jar \
+		${STAGEDIR}${JAVAJARDIR}/jss-tomcat.jar
+	${INSTALL_DATA} ${BUILD_WRKSRC}/jss-tomcat-9.0.jar \
+		${STAGEDIR}${JAVAJARDIR}/jss-tomcat-9.0.jar
+	@${MKDIR} ${STAGEDIR}${PREFIX}/lib
+	${INSTALL_LIB} ${BUILD_WRKSRC}/libjss.so \
+		${STAGEDIR}${PREFIX}/lib/libjss.so
+	${INSTALL_LIB} ${BUILD_WRKSRC}/symkey/libjss-symkey.so \
+		${STAGEDIR}${PREFIX}/lib/libjss-symkey.so
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libjss.so
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/libjss-symkey.so
+
+.include <bsd.port.mk>
diff --git a/security/dogtag-jss/distinfo b/security/dogtag-jss/distinfo
new file mode 100644
index 000000000000..5849ad5ce04c
--- /dev/null
+++ b/security/dogtag-jss/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1784227336
+SHA256 (dogtagpki-jss-v5.7.0_GH0.tar.gz) = d984b9fd81923d0a59300b7146ef9f6261112d3a9c84a5fda0bc38832bb5a689
+SIZE (dogtagpki-jss-v5.7.0_GH0.tar.gz) = 1219186
diff --git a/security/dogtag-jss/files/patch-CMakeLists.txt b/security/dogtag-jss/files/patch-CMakeLists.txt
new file mode 100644
index 000000000000..160851c02e2b
--- /dev/null
+++ b/security/dogtag-jss/files/patch-CMakeLists.txt
@@ -0,0 +1,98 @@
+--- CMakeLists.txt.orig	2026-07-16 15:13:37 UTC
++++ CMakeLists.txt
+@@ -110,6 +110,95 @@ add_subdirectory(tools)
+ 
+ add_subdirectory(tools)
+ 
++# Build jss-tomcat.jar.
++set(JSS_TOMCAT_CLASSES_DIR "${CMAKE_BINARY_DIR}/classes/jss-tomcat")
++set(JSS_TOMCAT_BUILD_JAR_PATH "${CMAKE_BINARY_DIR}/jss-tomcat-staging.jar")
++set(JSS_TOMCAT_JAR_PATH "${CMAKE_BINARY_DIR}/jss-tomcat.jar")
++file(MAKE_DIRECTORY "${JSS_TOMCAT_CLASSES_DIR}")
++
++javac(jss-tomcat-classes
++    SOURCE_DIR
++        ${CMAKE_SOURCE_DIR}/tomcat/src/main/java
++    SOURCES
++        *.java
++    CLASSPATH
++        ${JSS_JAR_PATH}
++        ${LANG_JAR}
++        ${SLF4J_API_JAR}
++    OUTPUT_DIR
++        ${JSS_TOMCAT_CLASSES_DIR}
++    DEPENDS
++        generate_jar
++)
++
++jar(jss-tomcat-build-jar
++    CREATE
++        ${JSS_TOMCAT_BUILD_JAR_PATH}
++    INPUT_DIR
++        ${JSS_TOMCAT_CLASSES_DIR}
++    DEPENDS
++        jss-tomcat-classes
++)
++
++add_custom_target(
++    jss-tomcat-jar
++    COMMAND "${PROJECT_SOURCE_DIR}/tools/reproducible_jar.sh"
++        "${JSS_TOMCAT_BUILD_JAR_PATH}"
++        "${CMAKE_BINARY_DIR}/reproducible-jss-tomcat"
++        "${JSS_TOMCAT_JAR_PATH}"
++    DEPENDS
++        jss-tomcat-build-jar
++)
++
++# Build jss-tomcat-9.0.jar.
++set(JSS_TOMCAT_9_0_CLASSES_DIR "${CMAKE_BINARY_DIR}/classes/jss-tomcat-9.0")
++set(JSS_TOMCAT_9_0_BUILD_JAR_PATH "${CMAKE_BINARY_DIR}/jss-tomcat-9.0-staging.jar")
++set(JSS_TOMCAT_9_0_JAR_PATH "${CMAKE_BINARY_DIR}/jss-tomcat-9.0.jar")
++file(MAKE_DIRECTORY "${JSS_TOMCAT_9_0_CLASSES_DIR}")
++
++javac(jss-tomcat-9.0-classes
++    SOURCE_DIR
++        ${CMAKE_SOURCE_DIR}/tomcat-9.0/src/main/java
++    SOURCES
++        *.java
++    CLASSPATH
++        ${JSS_JAR_PATH}
++        ${JSS_TOMCAT_JAR_PATH}
++        ${SLF4J_API_JAR}
++        ${TOMCAT_CATALINA_JAR}
++        ${TOMCAT_COYOTE_JAR}
++        ${TOMCAT_UTIL_JAR}
++        ${TOMCAT_JULI_JAR}
++    OUTPUT_DIR
++        ${JSS_TOMCAT_9_0_CLASSES_DIR}
++    DEPENDS
++        jss-tomcat-jar
++)
++
++jar(jss-tomcat-9.0-build-jar
++    CREATE
++        ${JSS_TOMCAT_9_0_BUILD_JAR_PATH}
++    INPUT_DIR
++        ${JSS_TOMCAT_9_0_CLASSES_DIR}
++    DEPENDS
++        jss-tomcat-9.0-classes
++)
++
++add_custom_target(
++    jss-tomcat-9.0-jar
++    COMMAND "${PROJECT_SOURCE_DIR}/tools/reproducible_jar.sh"
++        "${JSS_TOMCAT_9_0_BUILD_JAR_PATH}"
++        "${CMAKE_BINARY_DIR}/reproducible-jss-tomcat-9.0"
++        "${JSS_TOMCAT_9_0_JAR_PATH}"
++    DEPENDS
++        jss-tomcat-9.0-build-jar
++)
++
++add_dependencies(java
++    jss-tomcat-jar
++    jss-tomcat-9.0-jar
++)
++
+ if(WITH_TESTS)
+     add_dependencies(native generate_test_so)
+ endif(WITH_TESTS)
diff --git a/security/dogtag-jss/files/patch-cmake_JSSConfig.cmake b/security/dogtag-jss/files/patch-cmake_JSSConfig.cmake
new file mode 100644
index 000000000000..1cdefe06d38f
--- /dev/null
+++ b/security/dogtag-jss/files/patch-cmake_JSSConfig.cmake
@@ -0,0 +1,10 @@
+--- cmake/JSSConfig.cmake.orig	2026-07-16 09:37:55 UTC
++++ cmake/JSSConfig.cmake
+@@ -196,7 +196,6 @@ macro(jss_config_ldflags)
+     list(APPEND JSS_LD_FLAGS "-lplds4")
+     list(APPEND JSS_LD_FLAGS "-lnspr4")
+     list(APPEND JSS_LD_FLAGS "-lpthread")
+-    list(APPEND JSS_LD_FLAGS "-ldl")
+ 
+     separate_arguments(PASSED_LD_FLAGS UNIX_COMMAND "${CMAKE_SHARED_LINKER_FLAGS}")
+     foreach(PASSED_LD_FLAG ${PASSED_LD_FLAGS})
diff --git a/security/dogtag-jss/files/patch-symkey_CMakeLists.txt b/security/dogtag-jss/files/patch-symkey_CMakeLists.txt
new file mode 100644
index 000000000000..e13a1540f258
--- /dev/null
+++ b/security/dogtag-jss/files/patch-symkey_CMakeLists.txt
@@ -0,0 +1,11 @@
+--- symkey/CMakeLists.txt.orig	2026-07-16 09:37:55 UTC
++++ symkey/CMakeLists.txt
+@@ -41,7 +41,7 @@ target_link_libraries(${SYMKEY_SHARED_LIBRARY}
+ )
+ 
+ target_link_libraries(${SYMKEY_SHARED_LIBRARY}
+-    smime3 ssl3 nss3 nssutil3 plc4 plds4 nspr4 pthread dl)
++    smime3 ssl3 nss3 nssutil3 plc4 plds4 nspr4 pthread)
+ 
+ if(WITH_NATIVE)
+     install(
diff --git a/security/dogtag-jss/files/patch-tools_reproducible__jar.sh b/security/dogtag-jss/files/patch-tools_reproducible__jar.sh
new file mode 100644
index 000000000000..a528e493318d
--- /dev/null
+++ b/security/dogtag-jss/files/patch-tools_reproducible__jar.sh
@@ -0,0 +1,13 @@
+--- tools/reproducible_jar.sh.orig	2026-07-16 09:37:55 UTC
++++ tools/reproducible_jar.sh
+@@ -51,8 +51,8 @@ abs_jar="$(realpath "$1")"
+ }
+ 
+ abs_jar="$(realpath "$1")"
+-abs_path="$(realpath "$2")"
+-abs_output="$(realpath "$3")"
++abs_path="$(cd "$(dirname "$2")" && pwd)/$(basename "$2")"
++abs_output="$(cd "$(dirname "$3")" && pwd)/$(basename "$3")"
+ 
+ extract "$abs_jar" "$abs_path"
+ normalize_timestamps "$abs_path"
diff --git a/security/dogtag-jss/pkg-descr b/security/dogtag-jss/pkg-descr
new file mode 100644
index 000000000000..b2d00d93ebb0
--- /dev/null
+++ b/security/dogtag-jss/pkg-descr
@@ -0,0 +1,4 @@
+Java Security Services provides a Java interface to Mozilla NSS.
+It includes a Java security provider and native JNI libraries for
+cryptographic operations, certificate handling, and symmetric-key
+operations used by Dogtag PKI.