Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

78 files changed, 6920 insertions, 0 deletions

diff --git a/security/nss/coreconf/AIX.mk b/security/nss/coreconf/AIX.mk
new file mode 100644
index 0000000000..e158a6a41d
--- /dev/null
+++ b/security/nss/coreconf/AIX.mk
@@ -0,0 +1,67 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Config stuff for AIX.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+#
+# There are two implementation strategies available on AIX:
+# pthreads, and pthreads-user.  The default is pthreads.
+# In both strategies, we need to use pthread_user.c, instead of
+# aix.c.  The fact that aix.c is never used is somewhat strange.
+# 
+# So we need to do the following:
+# - Default (PTHREADS_USER not defined in the environment or on
+#   the command line):
+#   Set PTHREADS_USER=1, USE_PTHREADS=1
+# - PTHREADS_USER=1 set in the environment or on the command line:
+#   Do nothing.
+#
+ifeq ($(PTHREADS_USER),1)
+	USE_PTHREADS =            # just to be safe
+	IMPL_STRATEGY = _PTH_USER
+else
+	USE_PTHREADS = 1
+	PTHREADS_USER = 1
+endif
+
+DEFAULT_COMPILER = xlc_r
+
+CC		= xlc_r
+CCC		= xlC_r
+
+CPU_ARCH	= rs6000
+
+RANLIB		= ranlib
+
+OS_CFLAGS	= -DAIX -DSYSV
+OS_LIBS 	+= -blibpath:/usr/lib:/lib -lc -lm
+
+DSO_LDOPTS	= -brtl -bnortllib -bM:SRE -bnoentry
+MKSHLIB 	= $(LD) $(DSO_LDOPTS) -blibpath:/usr/lib:/lib -lc -lm
+
+AIX_WRAP	= $(DIST)/lib/aixwrap.o
+AIX_TMP		= $(OBJDIR)/_aix_tmp.o
+
+ifdef MAPFILE
+DSO_LDOPTS	+= -bexport:$(MAPFILE)
+else
+DSO_LDOPTS	+= -bexpall
+endif
+
+PROCESS_MAP_FILE = grep -v ';+' $< | grep -v ';-' | \
+                sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' > $@
+
+ifdef BUILD_OPT
+	OPTIMIZER += -qmaxmem=-1
+endif
+
+ifeq ($(USE_64), 1)
+	OS_CFLAGS	+= -DAIX_64BIT
+	OBJECT_MODE=64
+	export OBJECT_MODE
+endif
+
diff --git a/security/nss/coreconf/Android.mk b/security/nss/coreconf/Android.mk
new file mode 100644
index 0000000000..415812a7e5
--- /dev/null
+++ b/security/nss/coreconf/Android.mk
@@ -0,0 +1,6 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/Linux.mk
diff --git a/security/nss/coreconf/BSD_OS.mk b/security/nss/coreconf/BSD_OS.mk
new file mode 100644
index 0000000000..81b2b25c79
--- /dev/null
+++ b/security/nss/coreconf/BSD_OS.mk
@@ -0,0 +1,56 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER	= gcc
+CC			= gcc
+CCC			= g++
+RANLIB			= ranlib
+
+ifeq ($(OS_TEST),i386)
+	OS_REL_CFLAGS	= -D__i386__
+	CPU_ARCH	= x86
+else
+ifeq ($(OS_TEST),ppc)
+	OS_REL_CFLAGS	= -D__ppc__
+	CPU_ARCH	= ppc
+else
+ifeq ($(OS_TEST),sparc)
+	OS_REL_CFLAGS	= -D__sparc__
+	CPU_ARCH	= sparc
+else
+# treat the ultrasparc like a regular sparc, at least for now!
+ifeq ($(OS_TEST),sparc_v9)
+	OS_REL_CFLAGS	= -D__sparc__
+	CPU_ARCH	= sparc
+endif
+endif
+endif
+endif
+
+DLL_SUFFIX		= so
+
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -DBSD_OS -DBSDI -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+
+ARCH			= bsdos
+
+DSO_CFLAGS		= -fPIC -DPIC
+DSO_LDOPTS		= -shared -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+
+ifdef LIBRUNPATH
+DSO_LDOPTS		+= -Wl,-R$(LIBRUNPATH)
+endif
+
+MKSHLIB			= $(CC) $(DSO_LDOPTS)
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+G++INCLUDES		= -I/usr/include/g++
+
+INCLUDES		+= -I/usr/X11R6/include
diff --git a/security/nss/coreconf/Darwin.mk b/security/nss/coreconf/Darwin.mk
new file mode 100644
index 0000000000..0569e1819d
--- /dev/null
+++ b/security/nss/coreconf/Darwin.mk
@@ -0,0 +1,147 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CC     ?= gcc
+CCC    ?= g++
+RANLIB ?= ranlib
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+include $(CORE_DEPTH)/coreconf/Werror.mk
+
+DEFAULT_COMPILER = gcc
+
+ifndef CPU_ARCH
+# When cross-compiling, CPU_ARCH should already be defined as the target
+# architecture, set to powerpc or i386.
+CPU_ARCH	:= $(shell uname -p)
+endif
+
+ifeq (,$(filter-out i%86,$(CPU_ARCH)))
+ifdef USE_64
+CC              += -arch x86_64
+CCC             += -arch x86_64
+override CPU_ARCH	= x86_64
+else
+OS_REL_CFLAGS	= -Di386
+CC              += -arch i386
+CCC             += -arch i386
+override CPU_ARCH	= x86
+endif
+else
+ifeq (arm,$(CPU_ARCH))
+# Nothing set for arm currently.
+else
+OS_REL_CFLAGS	= -Dppc
+CC              += -arch ppc
+CCC             += -arch ppc
+endif
+endif
+
+ifneq (,$(MACOS_SDK_DIR))
+    GCC_VERSION_FULL := $(shell $(CC) -dumpversion)
+    GCC_VERSION_MAJOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$1 }')
+    GCC_VERSION_MINOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$2 }')
+    GCC_VERSION = $(GCC_VERSION_MAJOR).$(GCC_VERSION_MINOR)
+
+    ifeq (,$(filter-out 2 3,$(GCC_VERSION_MAJOR)))
+        # GCC <= 3
+        DARWIN_SDK_FRAMEWORKS = -F$(MACOS_SDK_DIR)/System/Library/Frameworks
+        ifneq (,$(shell find $(MACOS_SDK_DIR)/Library/Frameworks -maxdepth 0))
+            DARWIN_SDK_FRAMEWORKS += -F$(MACOS_SDK_DIR)/Library/Frameworks
+        endif
+        DARWIN_SDK_CFLAGS = -nostdinc -isystem $(MACOS_SDK_DIR)/usr/include/gcc/darwin/$(GCC_VERSION) -isystem $(MACOS_SDK_DIR)/usr/include $(DARWIN_SDK_FRAMEWORKS)
+        DARWIN_SDK_LDFLAGS = -L$(MACOS_SDK_DIR)/usr/lib/gcc/darwin -L$(MACOS_SDK_DIR)/usr/lib/gcc/darwin/$(GCC_VERSION_FULL) -L$(MACOS_SDK_DIR)/usr/lib
+        DARWIN_SDK_SHLIBFLAGS = $(DARWIN_SDK_LDFLAGS) $(DARWIN_SDK_FRAMEWORKS)
+        NEXT_ROOT = $(MACOS_SDK_DIR)
+        export NEXT_ROOT
+    else
+        # GCC >= 4
+        DARWIN_SDK_CFLAGS = -isysroot $(MACOS_SDK_DIR)
+        ifneq (4.0.0,$(GCC_VERSION_FULL))
+            # gcc > 4.0.0 passes -syslibroot to ld based on -isysroot.
+            # Don't add -isysroot to DARWIN_SDK_LDFLAGS, because the programs
+            # that are linked with those flags also get DARWIN_SDK_CFLAGS.
+            DARWIN_SDK_SHLIBFLAGS = -isysroot $(MACOS_SDK_DIR)
+        else
+            # gcc 4.0.0 doesn't pass -syslibroot to ld, it needs to be
+            # explicit.
+            DARWIN_SDK_LDFLAGS = -Wl,-syslibroot,$(MACOS_SDK_DIR)
+            DARWIN_SDK_SHLIBFLAGS = $(DARWIN_SDK_LDFLAGS)
+        endif
+    endif
+
+    LDFLAGS += $(DARWIN_SDK_LDFLAGS)
+endif
+
+# "Commons" are tentative definitions in a global scope, like this:
+#     int x;
+# The meaning of a common is ambiguous.  It may be a true definition:
+#     int x = 0;
+# or it may be a declaration of a symbol defined in another file:
+#     extern int x;
+# Use the -fno-common option to force all commons to become true
+# definitions so that the linker can catch multiply-defined symbols.
+# Also, common symbols are not allowed with Darwin dynamic libraries.
+
+OS_CFLAGS	= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK $(DARWIN_SDK_CFLAGS)
+
+ifdef BUILD_OPT
+ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
+	OPTIMIZER       = -Oz
+else
+	OPTIMIZER	= -O2
+endif
+ifdef MOZ_DEBUG_SYMBOLS
+	ifdef MOZ_DEBUG_FLAGS
+		OPTIMIZER += $(MOZ_DEBUG_FLAGS)
+	else
+		OPTIMIZER += -gdwarf-2 -gfull
+	endif
+endif
+endif
+
+ARCH		= darwin
+
+DSO_CFLAGS	= -fPIC
+# May override this with different compatibility and current version numbers.
+DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
+# May override this with -bundle to create a loadable module.
+DSO_LDOPTS	= -dynamiclib $(DARWIN_DYLIB_VERSIONS) -install_name @executable_path/$(notdir $@) -headerpad_max_install_names
+
+ifdef USE_GCOV
+   OS_CFLAGS += --coverage
+   LDFLAGS += --coverage
+   DSO_LDOPTS += --coverage
+endif
+
+MKSHLIB		= $(CC) $(DSO_LDOPTS) $(DARWIN_SDK_SHLIBFLAGS)
+DLL_SUFFIX	= dylib
+ifdef MAPFILE
+	MKSHLIB += -exported_symbols_list $(MAPFILE)
+endif
+PROCESS_MAP_FILE = grep -v ';+' $< | grep -v ';-' | \
+                sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' -e 's,^,_,' > $@
+
+USE_SYSTEM_ZLIB = 1
+ZLIB_LIBS	= -lz
+
+# The system sqlite library in the latest version of Mac OS X often becomes
+# newer than the sqlite library in NSS. This may result in certain Mac OS X
+# system libraries having unresolved sqlite symbols during the shlibsign step
+# of the NSS build when we set DYLD_LIBRARY_PATH to the NSS lib directory and
+# the NSS libsqlite3.dylib is used instead of the system one. So just use the
+# system sqlite library on Mac, if it's sufficiently new.
+
+SYS_SQLITE3_VERSION_FULL := $(shell /usr/bin/sqlite3 -version | awk '{print $$1}')
+SYS_SQLITE3_VERSION_MAJOR := $(shell echo $(SYS_SQLITE3_VERSION_FULL) | awk -F. '{ print $$1 }')
+SYS_SQLITE3_VERSION_MINOR := $(shell echo $(SYS_SQLITE3_VERSION_FULL) | awk -F. '{ print $$2 }')
+
+ifeq (3,$(SYS_SQLITE3_VERSION_MAJOR))
+    ifeq (,$(filter-out 0 1 2 3 4,$(SYS_SQLITE3_VERSION_MINOR)))
+        # sqlite <= 3.4.x is too old, it doesn't provide sqlite3_file_control
+    else
+        NSS_USE_SYSTEM_SQLITE = 1
+    endif
+endif
diff --git a/security/nss/coreconf/FreeBSD.mk b/security/nss/coreconf/FreeBSD.mk
new file mode 100644
index 0000000000..fcbf23f6a6
--- /dev/null
+++ b/security/nss/coreconf/FreeBSD.mk
@@ -0,0 +1,58 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER	= gcc
+CC			= gcc
+CCC			= g++
+RANLIB			= ranlib
+
+CPU_ARCH		= $(OS_TEST)
+ifeq ($(CPU_ARCH),i386)
+CPU_ARCH		= x86
+endif
+ifeq ($(CPU_ARCH),pc98)
+CPU_ARCH		= x86
+endif
+ifeq ($(CPU_ARCH),amd64)
+CPU_ARCH		= x86_64
+endif
+
+OS_CFLAGS		= $(DSO_CFLAGS) -Wall -Wno-switch -DFREEBSD -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+
+DSO_CFLAGS		= -fPIC
+DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
+
+#
+# The default implementation strategy for FreeBSD is pthreads.
+#
+ifndef CLASSIC_NSPR
+USE_PTHREADS		= 1
+DEFINES			+= -D_THREAD_SAFE -D_REENTRANT
+OS_LIBS			+= -pthread
+DSO_LDOPTS		+= -pthread
+endif
+
+ARCH			= freebsd
+
+MOZ_OBJFORMAT		:= $(shell test -x /usr/bin/objformat && /usr/bin/objformat || echo elf)
+
+ifeq ($(MOZ_OBJFORMAT),elf)
+DLL_SUFFIX		= so
+else
+DLL_SUFFIX		= so.1.0
+endif
+
+MKSHLIB			= $(CC) $(DSO_LDOPTS)
+ifdef MAPFILE
+	MKSHLIB += -Wl,--version-script,$(MAPFILE)
+endif
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+        sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
+
+G++INCLUDES		= -I/usr/include/g++
+
+INCLUDES		+= -I/usr/X11R6/include
diff --git a/security/nss/coreconf/HP-UX.mk b/security/nss/coreconf/HP-UX.mk
new file mode 100644
index 0000000000..d18fa1489a
--- /dev/null
+++ b/security/nss/coreconf/HP-UX.mk
@@ -0,0 +1,84 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Config stuff for HP-UX
+#
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = cc
+
+ifeq ($(OS_TEST),ia64)
+	CPU_ARCH = ia64
+	CPU_TAG = _$(CPU_ARCH)
+	ifneq ($(USE_64),1)
+		64BIT_TAG = _32
+	endif
+	DLL_SUFFIX = so
+else
+	CPU_ARCH = hppa
+	DLL_SUFFIX = sl
+endif
+CC         = cc
+CCC        = CC
+ifndef NS_USE_GCC
+OS_CFLAGS  += -Ae
+endif
+OS_CFLAGS  += $(DSO_CFLAGS) -DHPUX -D$(CPU_ARCH) -D_HPUX_SOURCE -D_USE_BIG_FDS
+
+ifeq ($(DEFAULT_IMPL_STRATEGY),_PTH)
+	USE_PTHREADS = 1
+	ifeq ($(CLASSIC_NSPR),1)
+		USE_PTHREADS =
+		IMPL_STRATEGY = _CLASSIC
+	endif
+	ifeq ($(PTHREADS_USER),1)
+		USE_PTHREADS =
+		IMPL_STRATEGY = _PTH_USER
+	endif
+endif
+
+ifdef PTHREADS_USER
+	OS_CFLAGS	+= -D_POSIX_C_SOURCE=199506L
+endif
+
+LDFLAGS			= -z -Wl,+s
+
+ifdef NS_USE_GCC
+LD = $(CC)
+endif
+MKSHLIB			= $(LD) $(DSO_LDOPTS) $(RPATH)
+ifdef MAPFILE
+ifndef NS_USE_GCC
+MKSHLIB += -c $(MAPFILE)
+else
+MKSHLIB += -Wl,-c,$(MAPFILE)
+endif
+endif
+PROCESS_MAP_FILE = grep -v ';+' $< | grep -v ';-' | \
+         sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' -e 's,^,+e ,' > $@
+
+ifndef NS_USE_GCC
+DSO_LDOPTS		= -b +h $(notdir $@)
+RPATH			= +b '$$ORIGIN'
+else
+DSO_LDOPTS		= -shared -Wl,+h,$(notdir $@)
+RPATH			= -Wl,+b,'$$ORIGIN'
+endif
+ifneq ($(OS_TEST),ia64)
+# pa-risc
+ifndef USE_64
+RPATH			=
+endif
+endif
+
+# +Z generates position independent code for use in shared libraries.
+ifndef NS_USE_GCC
+DSO_CFLAGS = +Z
+else
+DSO_CFLAGS = -fPIC
+ASFLAGS   += -x assembler-with-cpp
+endif
diff --git a/security/nss/coreconf/HP-UXA.09.03.mk b/security/nss/coreconf/HP-UXA.09.03.mk
new file mode 100644
index 0000000000..991b79468b
--- /dev/null
+++ b/security/nss/coreconf/HP-UXA.09.03.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# On HP-UX 9, the default (and only) implementation strategy is
+# classic nspr.
+#
+ifeq ($(OS_RELEASE),A.09.03)
+	DEFAULT_IMPL_STRATEGY	 = _CLASSIC
+endif
+
+#
+# Config stuff for HP-UXA.09.03
+#
+include $(CORE_DEPTH)/coreconf/HP-UXA.09.mk
diff --git a/security/nss/coreconf/HP-UXA.09.07.mk b/security/nss/coreconf/HP-UXA.09.07.mk
new file mode 100644
index 0000000000..7c2266f5f0
--- /dev/null
+++ b/security/nss/coreconf/HP-UXA.09.07.mk
@@ -0,0 +1,16 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 9, the default (and only) implementation strategy is
+# classic nspr.
+
+ifeq ($(OS_RELEASE),A.09.07)
+	DEFAULT_IMPL_STRATEGY	 = _CLASSIC
+endif
+
+#
+# Config stuff for HP-UXA.09.07
+#
+include $(CORE_DEPTH)/coreconf/HP-UXA.09.mk
diff --git a/security/nss/coreconf/HP-UXA.09.mk b/security/nss/coreconf/HP-UXA.09.mk
new file mode 100644
index 0000000000..60bde35d6d
--- /dev/null
+++ b/security/nss/coreconf/HP-UXA.09.mk
@@ -0,0 +1,11 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Config stuff for HP-UXA.09
+#
+include $(CORE_DEPTH)/coreconf/HP-UX.mk
+
+OS_CFLAGS += -DHPUX9
diff --git a/security/nss/coreconf/HP-UXB.10.01.mk b/security/nss/coreconf/HP-UXB.10.01.mk
new file mode 100644
index 0000000000..d2429b24d4
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.10.01.mk
@@ -0,0 +1,12 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ifeq ($(OS_RELEASE),B.10.01)
+	DEFAULT_IMPL_STRATEGY	 = _CLASSIC
+endif
+
+#
+# Config stuff for HP-UXB.10.01
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.10.mk
diff --git a/security/nss/coreconf/HP-UXB.10.10.mk b/security/nss/coreconf/HP-UXB.10.10.mk
new file mode 100644
index 0000000000..c1b0990796
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.10.10.mk
@@ -0,0 +1,22 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.10 and 10.20, the default implementation strategy is
+# pthreads (actually DCE threads).  Classic nspr is also available.
+
+ifeq ($(OS_RELEASE),B.10.10)
+	DEFAULT_IMPL_STRATEGY 	 = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.10.10
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.10.mk
+
+OS_CFLAGS += -DHPUX10_10
+
+ifeq ($(USE_PTHREADS),1)
+	OS_CFLAGS	+= -D_REENTRANT
+endif
diff --git a/security/nss/coreconf/HP-UXB.10.20.mk b/security/nss/coreconf/HP-UXB.10.20.mk
new file mode 100644
index 0000000000..219ae7b681
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.10.20.mk
@@ -0,0 +1,22 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.10 and 10.20, the default implementation strategy is
+# pthreads (actually DCE threads).  Classic nspr is also available.
+
+ifeq ($(OS_RELEASE),B.10.20)
+	DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.10.20
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.10.mk
+
+OS_CFLAGS		+= -DHPUX10_20
+
+ifeq ($(USE_PTHREADS),1)
+	OS_CFLAGS	+= -D_REENTRANT
+endif
diff --git a/security/nss/coreconf/HP-UXB.10.30.mk b/security/nss/coreconf/HP-UXB.10.30.mk
new file mode 100644
index 0000000000..f09991a0b1
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.10.30.mk
@@ -0,0 +1,28 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.00, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.10.30)
+	DEFAULT_IMPL_STRATEGY	 = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.10.30.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.10.mk
+
+OS_CFLAGS		+= -DHPUX10_30
+
+#
+# To use the true pthread (kernel thread) library on 10.30 and
+# 11.00, we should define _POSIX_C_SOURCE to be 199506L.
+# The _REENTRANT macro is deprecated.
+#
+
+ifdef USE_PTHREADS
+	OS_CFLAGS	+= -D_POSIX_C_SOURCE=199506L
+endif
diff --git a/security/nss/coreconf/HP-UXB.10.mk b/security/nss/coreconf/HP-UXB.10.mk
new file mode 100644
index 0000000000..02243480d0
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.10.mk
@@ -0,0 +1,8 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+include $(CORE_DEPTH)/coreconf/HP-UX.mk
+
+OS_CFLAGS += -DHPUX10
+OS_LIBS   += -lpthread -lm
diff --git a/security/nss/coreconf/HP-UXB.11.00.mk b/security/nss/coreconf/HP-UXB.11.00.mk
new file mode 100644
index 0000000000..624ae97283
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.00.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.00, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.11.00)
+OS_CFLAGS		+= -DHPUX10
+DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.11.00.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.11.mk
diff --git a/security/nss/coreconf/HP-UXB.11.11.mk b/security/nss/coreconf/HP-UXB.11.11.mk
new file mode 100644
index 0000000000..9c43ca2a2e
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.11.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.x, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.11.11)
+OS_CFLAGS		+= -DHPUX10
+DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.11.11.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.11.mk
diff --git a/security/nss/coreconf/HP-UXB.11.20.mk b/security/nss/coreconf/HP-UXB.11.20.mk
new file mode 100644
index 0000000000..f7e32c9d1e
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.20.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.x, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.11.20)
+OS_CFLAGS		+= -DHPUX10
+DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.11.x.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.11.mk
diff --git a/security/nss/coreconf/HP-UXB.11.22.mk b/security/nss/coreconf/HP-UXB.11.22.mk
new file mode 100644
index 0000000000..a29ef07f4a
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.22.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.x, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.11.22)
+OS_CFLAGS		+= -DHPUX10
+DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.11.x.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.11.mk
diff --git a/security/nss/coreconf/HP-UXB.11.23.mk b/security/nss/coreconf/HP-UXB.11.23.mk
new file mode 100644
index 0000000000..1751b8d373
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.23.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On HP-UX 10.30 and 11.x, the default implementation strategy is
+# pthreads.  Classic nspr and pthreads-user are also available.
+
+ifeq ($(OS_RELEASE),B.11.23)
+OS_CFLAGS		+= -DHPUX10
+DEFAULT_IMPL_STRATEGY = _PTH
+endif
+
+#
+# Config stuff for HP-UXB.11.x.
+#
+include $(CORE_DEPTH)/coreconf/HP-UXB.11.mk
diff --git a/security/nss/coreconf/HP-UXB.11.mk b/security/nss/coreconf/HP-UXB.11.mk
new file mode 100644
index 0000000000..c61b3f6b6f
--- /dev/null
+++ b/security/nss/coreconf/HP-UXB.11.mk
@@ -0,0 +1,48 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+include $(CORE_DEPTH)/coreconf/HP-UX.mk
+
+ifndef NS_USE_GCC
+    CCC                 = /opt/aCC/bin/aCC -ext
+    ifeq ($(USE_64), 1)
+	ifeq ($(OS_TEST), ia64)
+	    ARCHFLAG	= -Aa +e +p +DD64
+	else
+	    # Our HP-UX build machine has a strange problem.  If
+	    # a 64-bit PA-RISC executable calls getcwd() in a
+	    # network-mounted directory, it fails with ENOENT.
+	    # We don't know why.  Since nsinstall calls getcwd(),
+	    # this breaks our 64-bit HP-UX nightly builds.  None
+	    # of our other HP-UX machines have this problem.
+	    #
+	    # We worked around this problem by building nsinstall
+	    # as a 32-bit PA-RISC executable for 64-bit PA-RISC
+	    # builds.  -- wtc 2003-06-03
+	    ifdef INTERNAL_TOOLS
+	    ARCHFLAG	= +DAportable +DS2.0
+	    else
+	    ARCHFLAG	= -Aa +e +DA2.0W +DS2.0 +DChpux
+	    endif
+	endif
+    else
+	ifeq ($(OS_TEST), ia64)
+	    ARCHFLAG	= -Aa +e +p +DD32
+	else
+	    ARCHFLAG	= +DAportable +DS2.0
+	endif
+    endif
+else
+    CCC = aCC
+endif
+
+#
+# To use the true pthread (kernel thread) library on HP-UX
+# 11.x, we should define _POSIX_C_SOURCE to be 199506L.
+# The _REENTRANT macro is deprecated.
+#
+
+OS_CFLAGS += $(ARCHFLAG) -DHPUX11 -D_POSIX_C_SOURCE=199506L
+OS_LIBS   += -lpthread -lm -lrt
+HPUX11	= 1
diff --git a/security/nss/coreconf/Linux.mk b/security/nss/coreconf/Linux.mk
new file mode 100644
index 0000000000..dcb432415f
--- /dev/null
+++ b/security/nss/coreconf/Linux.mk
@@ -0,0 +1,220 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CC     ?= gcc
+CCC    ?= g++
+RANLIB ?= ranlib
+LD     ?= ld
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+#
+# The default implementation strategy for Linux is now pthreads
+#
+ifneq ($(OS_TARGET),Android)
+	USE_PTHREADS = 1
+endif
+
+ifeq ($(USE_PTHREADS),1)
+	IMPL_STRATEGY = _PTH
+endif
+
+DEFAULT_COMPILER = gcc
+DEFINES += -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -DSDB_MEASURE_USE_TEMP_DIR
+
+ifeq ($(OS_TARGET),Android)
+ifndef ANDROID_NDK
+	$(error Must set ANDROID_NDK to the path to the android NDK first)
+endif
+ifndef ANDROID_TOOLCHAIN_VERSION
+	$(error Must set ANDROID_TOOLCHAIN_VERSION to the requested version number)
+endif
+	ANDROID_PREFIX=$(OS_TEST)-linux-androideabi
+	ANDROID_TARGET=$(ANDROID_PREFIX)-$(ANDROID_TOOLCHAIN_VERSION)
+	# should autodetect which linux we are on, currently android only
+	# supports linux-x86 prebuilts
+	ANDROID_TOOLCHAIN=$(ANDROID_NDK)/toolchains/$(ANDROID_TARGET)/prebuilt/linux-x86
+	ANDROID_SYSROOT=$(ANDROID_NDK)/platforms/android-$(OS_TARGET_RELEASE)/arch-$(OS_TEST)
+	ANDROID_CC=$(ANDROID_TOOLCHAIN)/bin/$(ANDROID_PREFIX)-gcc
+	ANDROID_CCC=$(ANDROID_TOOLCHAIN)/bin/$(ANDROID_PREFIX)-g++
+        NSS_DISABLE_GTESTS=1
+# internal tools need to be built with the native compiler
+ifndef INTERNAL_TOOLS
+	CC = $(ANDROID_CC) --sysroot=$(ANDROID_SYSROOT)
+	CCC = $(ANDROID_CCC) --sysroot=$(ANDROID_SYSROOT)
+	DEFAULT_COMPILER=$(ANDROID_PREFIX)-gcc
+	ARCHFLAG = --sysroot=$(ANDROID_SYSROOT)
+	DEFINES += -DNO_SYSINFO -DNO_FORK_CHECK -DANDROID
+	CROSS_COMPILE = 1
+endif
+endif
+ifeq (,$(filter-out ppc64 ppc64le,$(OS_TEST)))
+	CPU_ARCH	= ppc
+ifeq ($(USE_64),1)
+	ARCHFLAG	= -m64
+endif
+ifeq (,$(filter-out ppc ppc64,$(OS_TEST)))
+ifneq ($(NSS_DISABLE_CRYPTO_VSX),0)
+	NSS_DISABLE_CRYPTO_VSX=1
+endif
+endif
+else
+ifeq ($(OS_TEST),alpha)
+        OS_REL_CFLAGS   = -D_ALPHA_
+	CPU_ARCH	= alpha
+else
+ifeq ($(OS_TEST),x86_64)
+ifeq ($(USE_64),1)
+	CPU_ARCH	= x86_64
+	ARCHFLAG	= -m64
+else
+ifeq ($(USE_X32),1)
+	CPU_ARCH	= x86_64
+	ARCHFLAG	= -mx32
+	64BIT_TAG	= _x32
+else
+	OS_REL_CFLAGS	= -Di386
+	CPU_ARCH	= x86
+	ARCHFLAG	= -m32
+endif
+endif
+else
+ifeq ($(OS_TEST),sparc64)
+	CPU_ARCH        = sparc
+else
+ifeq (,$(filter-out arm% sa110,$(OS_TEST)))
+	CPU_ARCH        = arm
+else
+ifeq (,$(filter-out parisc%,$(OS_TEST)))
+	CPU_ARCH        = hppa
+else
+ifeq (,$(filter-out i%86,$(OS_TEST)))
+	OS_REL_CFLAGS	= -Di386
+	CPU_ARCH	= x86
+else
+ifeq ($(OS_TEST),sh4a)
+	CPU_ARCH        = sh4
+else
+# $(OS_TEST) == m68k, ppc, ia64, sparc, s390, s390x, mips, sh3, sh4
+	CPU_ARCH	= $(OS_TEST)
+endif
+endif
+endif
+endif
+endif
+endif
+endif
+endif
+
+
+ifneq ($(OS_TARGET),Android)
+LIBC_TAG		= _glibc
+endif
+
+ifdef BUILD_OPT
+ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
+	OPTIMIZER = -Os
+else
+	OPTIMIZER = -O2
+endif
+ifdef MOZ_DEBUG_SYMBOLS
+	ifdef MOZ_DEBUG_FLAGS
+		OPTIMIZER += $(MOZ_DEBUG_FLAGS)
+	else
+		OPTIMIZER += -gdwarf-2
+	endif
+endif
+endif
+
+ifndef COMPILER_TAG
+COMPILER_TAG := _$(CC_NAME)
+endif
+
+ifeq ($(USE_PTHREADS),1)
+OS_PTHREAD = -lpthread 
+endif
+
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) $(ARCHFLAG) -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR
+ifeq ($(KERNEL),Linux)
+	OS_CFLAGS	+= -DLINUX -Dlinux
+endif
+OS_LIBS			= $(OS_PTHREAD) -ldl -lc
+
+ifeq ($(OS_TARGET),Android)
+	OS_LIBS		+= -llog
+endif
+
+ifdef USE_PTHREADS
+	DEFINES		+= -D_REENTRANT
+endif
+
+DSO_CFLAGS		= -fPIC
+DSO_LDOPTS		= -shared $(ARCHFLAG) -Wl,--gc-sections
+# The linker on Red Hat Linux 7.2 and RHEL 2.1 (GNU ld version 2.11.90.0.8)
+# incorrectly reports undefined references in the libraries we link with, so
+# we don't use -z defs there.
+# Also, -z defs conflicts with Address Sanitizer, which emits relocations
+# against the libsanitizer runtime built into the main executable.
+ZDEFS_FLAG		= -Wl,-z,defs
+DSO_LDOPTS     += $(if $(findstring 2.11.90.0.8,$(shell $(LD) -v)),,$(ZDEFS_FLAG))
+LDFLAGS		   += $(ARCHFLAG) -z noexecstack
+
+# On Maemo, we need to use the -rpath-link flag for even the standard system
+# library directories.
+ifdef _SBOX_DIR
+LDFLAGS			+= -Wl,-rpath-link,/usr/lib:/lib
+endif
+
+G++INCLUDES		= -I/usr/include/g++
+
+#
+# Always set CPU_TAG on Linux.
+#
+CPU_TAG = _$(CPU_ARCH)
+
+#
+# On Linux 2.6 or later, build libfreebl3.so with no NSPR and libnssutil3.so
+# dependencies by default.  Set FREEBL_NO_DEPEND to 0 in the environment to
+# override this.
+#
+ifneq ($(OS_TARGET),Android)
+ifeq (2.6,$(firstword $(sort 2.6 $(OS_RELEASE))))
+ifndef FREEBL_NO_DEPEND
+FREEBL_NO_DEPEND = 1
+FREEBL_LOWHASH = 1
+endif
+endif
+endif
+
+USE_SYSTEM_ZLIB = 1
+ZLIB_LIBS = -lz
+
+# The -rpath '$$ORIGIN' linker option instructs this library to search for its
+# dependencies in the same directory where it resides.
+ifeq ($(BUILD_SUN_PKG), 1)
+ifeq ($(USE_64), 1)
+RPATH = -Wl,-rpath,'$$ORIGIN:/opt/sun/private/lib64:/opt/sun/private/lib'
+else
+RPATH = -Wl,-rpath,'$$ORIGIN:/opt/sun/private/lib'
+endif
+endif
+
+MKSHLIB         = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so) $(RPATH)
+
+ifdef MAPFILE
+	MKSHLIB += -Wl,--version-script,$(MAPFILE)
+endif
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+        sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
+
+ifeq ($(OS_RELEASE),2.4)
+DEFINES += -DNO_FORK_CHECK
+endif
+
+ifdef USE_GCOV
+OS_CFLAGS += --coverage
+LDFLAGS += --coverage
+DSO_LDOPTS += --coverage
+endif
diff --git a/security/nss/coreconf/Makefile b/security/nss/coreconf/Makefile
new file mode 100644
index 0000000000..6ba154496d
--- /dev/null
+++ b/security/nss/coreconf/Makefile
@@ -0,0 +1,13 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+DEPTH		= ..
+CORE_DEPTH	= ..
+
+MODULE		= coreconf
+
+DIRS		= nsinstall
+
+include $(DEPTH)/coreconf/config.mk
+include $(DEPTH)/coreconf/rules.mk
diff --git a/security/nss/coreconf/NCR3.0.mk b/security/nss/coreconf/NCR3.0.mk
new file mode 100644
index 0000000000..7b8e31be3b
--- /dev/null
+++ b/security/nss/coreconf/NCR3.0.mk
@@ -0,0 +1,65 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = cc
+
+###
+NS_USE_NATIVE = 1
+
+# NS_USE_GCC = 1
+
+export PATH:=$(PATH):/opt/ncc/bin
+###
+
+RANLIB           = true
+GCC_FLAGS_EXTRA += -pipe
+
+DEFINES		+= -DSVR4 -DSYSV -DHAVE_STRERROR -DNCR
+
+OS_CFLAGS	+= -Hnocopyr -DSVR4 -DSYSV -DHAVE_STRERROR -DNCR -DPRFSTREAMS_BROKEN
+
+ifdef NS_USE_NATIVE
+	CC       = cc
+	CCC      = ncc
+	CXX      = ncc
+#	OS_LIBS += -L/opt/ncc/lib 
+else
+#	OS_LIBS	+=
+endif
+
+#OS_LIBS    += -lsocket -lnsl -ldl -lc
+
+MKSHLIB     += $(LD) $(DSO_LDOPTS)
+#DSO_LDOPTS += -G -z defs
+DSO_LDOPTS += -G
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+CPU_ARCH    = x86
+ARCH        = ncr
+
+NOSUCHFILE  = /solaris-rm-f-sucks
+
+# now take care of default GCC (rus@5/5/97)
+ 
+ifdef NS_USE_GCC
+	# if gcc-settings are redefined already - don't touch it
+	#
+	ifeq (,$(findstring gcc, $(CC)))
+		CC   = gcc
+		CCC  = g++
+		CXX  = g++
+		# always use -fPIC - some makefiles are still broken and don't distinguish
+		# situation when they build shared and static libraries
+		CFLAGS  += -fPIC -Wall -Wno-switch $(GCC_FLAGS_EXTRA)
+#		OS_LIBS += -L/usr/local/lib -lstdc++ -lg++ -lgcc
+	endif
+endif
+###
diff --git a/security/nss/coreconf/NEC4.2.mk b/security/nss/coreconf/NEC4.2.mk
new file mode 100644
index 0000000000..68cc1463c3
--- /dev/null
+++ b/security/nss/coreconf/NEC4.2.mk
@@ -0,0 +1,36 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = $(CORE_DEPTH)/build/hcc
+
+CPU_ARCH		= mips
+
+ifdef NS_USE_GCC
+CC			= gcc
+CCC			= g++
+else
+CC			= $(CORE_DEPTH)/build/hcc
+OS_CFLAGS		= -Xa -KGnum=0 -KOlimit=4000
+CCC			= g++
+endif
+
+MKSHLIB			= $(LD) $(DSO_LDOPTS)
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+RANLIB			= /bin/true
+
+OS_CFLAGS		+= $(ODD_CFLAGS) -DSVR4 -D__SVR4 -DNEC -Dnec_ews -DHAVE_STRERROR
+OS_LIBS			= -lsocket -lnsl -ldl $(LDOPTIONS)
+LDOPTIONS		= -lc -L/usr/ucblib -lucb
+
+NOSUCHFILE		= /nec-rm-f-sucks
+
+DSO_LDOPTS		= -G
diff --git a/security/nss/coreconf/NetBSD.mk b/security/nss/coreconf/NetBSD.mk
new file mode 100644
index 0000000000..05ebb18f10
--- /dev/null
+++ b/security/nss/coreconf/NetBSD.mk
@@ -0,0 +1,57 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+CC			?= gcc
+CXX			?= g++
+DEFAULT_COMPILER	= ${CC}
+CCC			= ${CXX}
+RANLIB			= ranlib
+
+CPU_ARCH		:= $(shell uname -p)
+ifeq ($(CPU_ARCH),i386)
+OS_REL_CFLAGS		= -Di386
+CPU_ARCH		= x86
+endif
+ifeq (,$(filter-out earm%,$(CPU_ARCH)))
+CPU_ARCH		= arm
+endif
+ifeq ($(CPU_ARCH),aarch64eb)
+CPU_ARCH		= aarch64
+endif
+
+DLL_SUFFIX		= so
+
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DNETBSD -Dunix -DHAVE_STRERROR -DHAVE_BSD_FLOCK
+
+OS_LIBS			= -lcompat
+
+ARCH			= netbsd
+
+DSO_CFLAGS		= -fPIC -DPIC
+DSO_LDOPTS		= -shared -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+
+#
+# The default implementation strategy for NetBSD is pthreads.
+#
+ifndef CLASSIC_NSPR
+USE_PTHREADS		= 1
+DEFINES			+= -D_THREAD_SAFE -D_REENTRANT
+OS_LIBS			+= -pthread
+DSO_LDOPTS		+= -pthread
+endif
+
+ifdef LIBRUNPATH
+DSO_LDOPTS		+= -Wl,-R$(LIBRUNPATH)
+endif
+
+MKSHLIB			= $(CC) $(DSO_LDOPTS)
+ifdef MAPFILE
+	MKSHLIB += -Wl,--version-script,$(MAPFILE)
+endif
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+        sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
+
diff --git a/security/nss/coreconf/OS2.mk b/security/nss/coreconf/OS2.mk
new file mode 100644
index 0000000000..4aa40eb6a3
--- /dev/null
+++ b/security/nss/coreconf/OS2.mk
@@ -0,0 +1,149 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+MOZ_WIDGET_TOOLKIT = os2
+
+# XP_PC is for Window and OS2 on Intel X86
+# XP_OS2 is strictly for OS2 only
+XP_DEFINE  += -DXP_PC=1  -DXP_OS2=1
+
+# Override prefix
+LIB_PREFIX  = $(NULL)
+
+# Override suffix in suffix.mk
+LIB_SUFFIX  = lib
+# the DLL_SUFFIX must be uppercase for FIPS mode to work. bugzilla 240784
+DLL_SUFFIX  = DLL
+PROG_SUFFIX = .exe
+
+
+CCC			= gcc
+LD  			= gcc
+AR                      = emxomfar r $@
+# Keep AR_FLAGS blank so that we do not have to change rules.mk
+AR_FLAGS                = 
+RANLIB 			= @echo OS2 RANLIB
+BSDECHO 		= @echo OS2 BSDECHO
+IMPLIB			= emximp -o
+FILTER			= emxexp -o
+
+# GCC for OS/2 currently predefines these, but we don't want them
+DEFINES 		+= -Uunix -U__unix -U__unix__
+
+DEFINES			+= -DTCPV40HDRS
+
+ifeq ($(MOZ_OS2_HIGH_MEMORY),1)
+HIGHMEM_LDFLAG          = -Zhigh-mem
+endif
+
+ifndef NO_SHARED_LIB
+DSO_CFLAGS              = 
+DSO_PIC_CFLAGS          = 
+MKSHLIB                 = $(CXX) $(CXXFLAGS) $(DSO_LDOPTS) -o $@
+MKCSHLIB                = $(CC) $(CFLAGS) $(DSO_LDOPTS) -o $@
+MKSHLIB_FORCE_ALL       = 
+MKSHLIB_UNFORCE_ALL     = 
+DSO_LDOPTS              = -Zomf -Zdll -Zmap $(HIGHMEM_LDFLAG)
+SHLIB_LDSTARTFILE	= 
+SHLIB_LDENDFILE		= 
+ifdef MAPFILE
+MKSHLIB += $(MAPFILE)
+endif
+PROCESS_MAP_FILE = \
+	echo LIBRARY $(LIBRARY_NAME)$(LIBRARY_VERSION) INITINSTANCE TERMINSTANCE > $@; \
+	echo PROTMODE >> $@; \
+	echo CODE    LOADONCALL MOVEABLE DISCARDABLE >> $@; \
+	echo DATA    PRELOAD MOVEABLE MULTIPLE NONSHARED >> $@; \
+	echo EXPORTS >> $@; \
+	grep -v ';+' $< | grep -v ';-' | \
+	sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' -e 's,\([\t ]*\),\1_,' | \
+	awk 'BEGIN {ord=1;} { print($$0 " @" ord " RESIDENTNAME"); ord++;}' >> $@
+
+endif   #NO_SHARED_LIB
+
+OS_CFLAGS          = -Wall -Wno-unused -Wpointer-arith -Wcast-align -Wno-switch -Zomf -DDEBUG -DTRACING -g
+
+ifdef BUILD_OPT
+ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
+	OPTIMIZER += -Os -s
+else
+	OPTIMIZER += -O2 -s
+endif
+DEFINES 		+= -UDEBUG -U_DEBUG -DNDEBUG
+DLLFLAGS		= -DLL -OUT:$@ -MAP:$(@:.dll=.map) $(HIGHMEM_LDFLAG)
+EXEFLAGS    		= -PMTYPE:VIO -OUT:$@ -MAP:$(@:.exe=.map) -nologo -NOE $(HIGHMEM_LDFLAG)
+OBJDIR_TAG 		= _OPT
+else
+#OPTIMIZER		= -O+ -Oi
+DEFINES 		+= -DDEBUG -D_DEBUG -DDEBUGPRINTS     #HCT Need += to avoid overidding manifest.mn 
+DLLFLAGS		= -DEBUG -DLL -OUT:$@ -MAP:$(@:.dll=.map) $(HIGHMEM_LDFLAG)
+EXEFLAGS    		= -DEBUG -PMTYPE:VIO -OUT:$@ -MAP:$(@:.exe=.map) -nologo -NOE $(HIGHMEM_LDFLAG)
+OBJDIR_TAG 		= _DBG
+LDFLAGS 		= -DEBUG $(HIGHMEM_LDFLAG)
+endif   # BUILD_OPT
+
+# OS/2 use nsinstall that is included in the toolkit.
+# since we do not wish to support and maintain 3 version of nsinstall in mozilla, nspr and nss
+
+ifdef BUILD_TREE
+NSINSTALL_DIR  = $(BUILD_TREE)/nss
+else
+NSINSTALL_DIR  = $(CORE_DEPTH)/coreconf/nsinstall
+endif
+# NSINSTALL      = $(NSINSTALL_DIR)/$(OBJDIR_NAME)/nsinstall
+NSINSTALL 	= nsinstall             # HCT4OS2
+INSTALL		= $(NSINSTALL)
+
+####################################################################
+#
+# One can define the makefile variable NSDISTMODE to control
+# how files are published to the 'dist' directory.  If not
+# defined, the default is "install using relative symbolic
+# links".  The two possible values are "copy", which copies files
+# but preserves source mtime, and "absolute_symlink", which
+# installs using absolute symbolic links.
+#   - THIS IS NOT PART OF THE NEW BINARY RELEASE PLAN for 9/30/97
+#   - WE'RE KEEPING IT ONLY FOR BACKWARDS COMPATIBILITY
+####################################################################
+
+ifeq ($(NSDISTMODE),copy)
+	# copy files, but preserve source mtime
+	INSTALL  = $(NSINSTALL)
+	INSTALL += -t
+else
+	ifeq ($(NSDISTMODE),absolute_symlink)
+		# install using absolute symbolic links
+		INSTALL  = $(NSINSTALL)
+		INSTALL += -L `pwd`
+	else
+		# install using relative symbolic links
+		INSTALL  = $(NSINSTALL)
+		INSTALL += -R
+	endif
+endif
+
+define MAKE_OBJDIR
+if test ! -d $(@D); then rm -rf $(@D); $(NSINSTALL) -D $(@D); fi
+endef
+
+#
+# override the definition of DLL_PREFIX in prefix.mk
+#
+
+ifndef DLL_PREFIX
+    DLL_PREFIX = $(NULL)
+endif
+
+ifndef IMPORT_LIB_SUFFIX
+    IMPORT_LIB_SUFFIX = .$(LIB_SUFFIX)
+endif
+
+#
+# override the TARGETS defined in ruleset.mk, adding IMPORT_LIBRARY
+#
+ifndef TARGETS
+    TARGETS = $(LIBRARY) $(SHARED_LIBRARY) $(IMPORT_LIBRARY) $(PROGRAM)
+endif
+
diff --git a/security/nss/coreconf/OpenBSD.mk b/security/nss/coreconf/OpenBSD.mk
new file mode 100644
index 0000000000..acf8507aa7
--- /dev/null
+++ b/security/nss/coreconf/OpenBSD.mk
@@ -0,0 +1,46 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+CC			?= gcc
+CXX			?= g++
+DEFAULT_COMPILER	= ${CC}
+CCC			= ${CXX}
+RANLIB			= ranlib
+
+CPU_ARCH		:= $(shell arch -s)
+ifeq ($(CPU_ARCH),i386)
+OS_REL_CFLAGS		= -Di386
+CPU_ARCH		= x86
+endif
+
+ifndef CLASSIC_NSPR
+USE_PTHREADS		= 1
+DEFINES			+= -pthread
+OS_LIBS			+= -pthread
+DSO_LDOPTS		+= -pthread
+endif
+
+DLL_SUFFIX		= so.1.0
+
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Wall -Wno-switch -pipe -DOPENBSD
+
+OS_LIBS			= 
+
+ARCH			= openbsd
+
+DSO_CFLAGS		= -fPIC -DPIC
+DSO_LDOPTS		= -shared -fPIC -Wl,-soname,lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+
+MKSHLIB			= $(CC) $(DSO_LDOPTS)
+ifdef MAPFILE
+	MKSHLIB += -Wl,--version-script,$(MAPFILE)
+endif
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+        sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
+
+USE_SYSTEM_ZLIB		= 1
+ZLIB_LIBS		= -lz
diff --git a/security/nss/coreconf/OpenUNIX.mk b/security/nss/coreconf/OpenUNIX.mk
new file mode 100644
index 0000000000..1afc80ac75
--- /dev/null
+++ b/security/nss/coreconf/OpenUNIX.mk
@@ -0,0 +1,57 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = gcc
+
+CC         = gcc
+OS_CFLAGS += -fPIC
+CCC        = g++
+CCC       += -DPRFSTREAMS_BROKEN -I/usr/gnu/lib/g++-include
+# CCC      = $(CORE_DEPTH)/build/hcpp
+# CCC     += +.cpp +w
+RANLIB     = /bin/true
+
+#
+# -DSCO_PM - Policy Manager AKA: SCO Licensing
+# -DSCO - Changes to Netscape source (consistent with AIX, LINUX, etc..)
+# -Dsco - Needed for /usr/include/X11/*
+#
+OS_CFLAGS   += -DSCO_SV -DSYSV -D_SVID3 -DHAVE_STRERROR -DSW_THREADS -DSCO_PM -DSCO -Dsco
+#OS_LIBS     += -lpmapi -lsocket -lc
+MKSHLIB      = $(LD)
+MKSHLIB     += $(DSO_LDOPTS)
+XINC         = /usr/include/X11
+MOTIFLIB    += -lXm
+INCLUDES    += -I$(XINC)
+CPU_ARCH     = x86
+GFX_ARCH     = x
+ARCH         = sco
+LOCALE_MAP   = $(CORE_DEPTH)/cmd/xfe/intl/sco.lm
+EN_LOCALE    = C
+DE_LOCALE    = de_DE.ISO8859-1
+FR_LOCALE    = fr_FR.ISO8859-1
+JP_LOCALE    = ja
+SJIS_LOCALE  = ja_JP.SJIS
+KR_LOCALE    = ko_KR.EUC
+CN_LOCALE    = zh
+TW_LOCALE    = zh
+I2_LOCALE    = i2
+LOC_LIB_DIR  = /usr/lib/X11
+NOSUCHFILE   = /solaris-rm-f-sucks
+BSDECHO      = /bin/echo
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+#
+# These defines are for building unix plugins
+#
+BUILD_UNIX_PLUGINS  = 1
+#DSO_LDOPTS         += -b elf -G -z defs
+DSO_LDOPTS         += -G
diff --git a/security/nss/coreconf/QNX.mk b/security/nss/coreconf/QNX.mk
new file mode 100644
index 0000000000..b1187cb7f4
--- /dev/null
+++ b/security/nss/coreconf/QNX.mk
@@ -0,0 +1,39 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+USE_PTHREADS = 1
+
+ifeq ($(USE_PTHREADS),1)
+	IMPL_STRATEGY = _PTH
+endif
+
+CC			= qcc
+CCC			= qcc
+RANLIB			= ranlib
+
+DEFAULT_COMPILER = qcc
+ifeq ($(OS_TEST),mips)
+	CPU_ARCH	= mips
+else
+	CPU_ARCH	= x86
+endif
+
+MKSHLIB		= $(CC) -shared -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so)
+ifdef BUILD_OPT
+	OPTIMIZER	= -O2
+endif
+
+OS_CFLAGS		= $(DSO_CFLAGS) $(OS_REL_CFLAGS) -Vgcc_ntox86 -Wall -pipe -DNTO -DHAVE_STRERROR -D_QNX_SOURCE -D_POSIX_C_SOURCE=199506 -D_XOPEN_SOURCE=500
+
+ifdef USE_PTHREADS
+	DEFINES		+= -D_REENTRANT
+endif
+
+ARCH			= QNX
+
+DSO_CFLAGS		= -Wc,-fPIC
+DSO_LDOPTS		= -shared
diff --git a/security/nss/coreconf/README b/security/nss/coreconf/README
new file mode 100644
index 0000000000..9d4c9e4547
--- /dev/null
+++ b/security/nss/coreconf/README
@@ -0,0 +1,510 @@
+OVERVIEW of "ns/coreconf":
+
+    This README file is an attempt to provide the reader with a simple
+    synopsis of the "ns/coreconf" build system which was originally
+    fundamentally designed and built to accomodate Netscape's binary
+    release model.  Wherever possible, an attempt has been made to
+    comply with the NSPR 2.0 build system, including mimicing the
+    compiler/linker flags, and directory naming structure.  The reader
+    should keep in mind that the system builds binary releases of
+    header files, class files, libraries, and executables on numerous
+    flavors of UNIX and Windows operating systems.  Unfortunately,
+    no serious attempt has ever been made to incorporate an ability to
+    generate cross-platform binaries on an Apple MacIntosh platform.
+
+    Note that this file will not attempt to redefine or document the
+    architecture of this system.  However, documents on this subject
+    are available at the following URL:
+
+        http://warp/hardcore/prj-ttools/specs/release/index.html
+
+
+
+DEPENDENCIES of "ns/coreconf":
+
+    The "ns/coreconf" build system requires the specified versions of
+    the following platform-dependent tools:
+
+        UNIX Platforms:
+        --------------
+        gmake (version 3.74 or later)
+        perl 4.0 (NOTE:  perl 5.003 or later recommended)
+        uname
+
+        Windows Platforms:
+        -----------------
+        gmake 3.74 (must use hacked Netscape version)
+        shmsdos.exe (contained in Netscape gmake.exe)
+        nsinstall.exe (contained in Netscape gmake.exe)
+        perl.exe (version 4.0 for everything except testing;
+                  NOTE:  MKS toolkit perl 5.002 is broken)
+        perl5.exe (for testing;
+                   NOTE:  perl 5.003 or later recommended;
+                          MKS toolkit perl 5.002 is broken)
+        uname.exe (use nstools version)
+
+ENHANCEMENTS to "ns/coreconf":
+
+    With the advent of Certificate Server 4.0 using the ns/coreconf
+    build system, several changes had to be made to enhance
+    ns/coreconf support for building Java/JNI classes/programs, as
+    well as libraries slated to be released as binaries.  While the
+    following may not represent an exhaustive list of these changes,
+    it does attempt to be at least somewhat comprehensive:
+
+        (1) During the course of these enhancements, a total of
+            four files have been modified, and four new files have
+            been added.
+
+            The following files have been modified:
+
+                - command.mk:    removed old definition of JAR
+
+                - config.mk:     added include statement of new
+                                 "jdk.mk" file
+
+                - ruleset.mk:    allowed the $(MKPROG) variable to be
+                                 overridden by supplying it with a
+                                 default value of $(CC); augmented
+                                 numerous definitions to enhance
+                                 ability of ns/coreconf to produce
+                                 a more robust set of libraries;
+                                 added some JNI definitions; PACKAGE
+                                 definition may be overridden by new
+                                 "jdk.mk" file
+
+                - rules.mk:      separated the compile phase of a
+                                 program from the link phase of a
+                                 program such that a developer can
+                                 now strictly override program linkage
+                                 by simply supplying a $(MKPROG)
+                                 variable; augmented NETLIBDEPTH
+                                 to use CORE_DEPTH but retain backward
+                                 compatibility; added JNI section;
+                                 modified .PRECIOUS rule;
+
+            The following files have been added:
+
+                - README:        this file; an ASCII-based text
+                                 document used to summarize the
+                                 ns/coreconf build system and
+                                 suitable (paginated) for printing
+
+                - jdk.mk:        a file comprising most (if not all)
+                                 of the default Java related build
+                                 information; the definitions in this
+                                 file are only included if NS_USE_JDK
+                                 has been defined
+
+                - jniregen.pl:   a perl script used to create a
+                                 dependency for when JNI files should
+                                 be regenerated (based upon any change
+                                 to the ".class" file from which the
+                                 ".h" file was originally generated)
+
+                - outofdate.pl:  a perl script used to create a
+                                 dependency for when ".class" files
+                                 should be regenerated (based upon
+                                 any change to the ".java" file
+                                 from which the ".class" file was
+                                 originally generated)
+
+        (2) As stated above, the ns/coreconf build system now separates
+            the link phase of a program from its compilation phase.
+            While ns/coreconf still works exactly as it used to because
+            the $(MKPROG) variable is assigned $(CC) by default, a developer
+            may now override this behavior by simply supplying their
+            own unique value for $(MKPROG) on every platform.  This allows
+            a program compiled with $(CC) to link with external libraries
+            that may contain "C++" linkage.  Before this change, a
+            programmer would need to reference their own local copy of
+            rules.mk (see the ns/sectools/cmd/pk12util program for
+            an example of how this used to be accomplished).
+
+        (3) Currently, the ns/coreconf build system differs from the
+            NSPR 2.0 build system which utilizes an "_s" to denote
+            static libraries from import libraries.  In fact, the
+            ns/coreconf build system adds no prefixes or suffixes to
+            distinguish one version of static libraries from another.
+            Note that both the ns/coreconf build system as well as the
+            NSPR 2.0 build system do nothing to provide a method of
+            distinguishing 16-bit from 32-bit static libraries on the
+            same machine, either, since:
+
+                a) this might only provide difficulty during
+                   development, since static libraries always
+                   need to be embedded within a program
+                   (note this is highly unlikely, since libraries
+                    for different platforms are subdivided via
+                    a well-known subdirectory structure, and
+                    a developer may use multiple trees for
+                    development),
+
+                b) this maintains backwards compatibility,
+                   something very important since no legacy
+                   programs will need to change their link phase, and
+
+                c) Netscape as a company has dropped any plans
+                   of future development of 16-bit products.
+
+        (4) Since several members of the Hardcore Security group did
+            not favor NSPR 2.0's solution of adding an "_s" to static
+            libraries on Windows platforms as a method to distinguish
+            them from their import library cousins, a different solution
+            was proposed and has been recently implemented for ns/coreconf:
+
+                - a 16 has been added as a suffix to both dynamic and
+                  import libraries built on 16-bit Windows platforms
+
+                - a 32 has been added as a suffix to both dynamic and
+                  import libraries built on 32-bit Windows platforms
+
+            Since the HCL release process currently only contains a
+            single instance of building a dynamic library,
+            ns/security/lib/fortcrypt/fort12.dll, the impact of this
+            change should be relatively small.  (Note: HCL was the
+            old name of NSS.)
+
+            It should be noted that although this would additionally
+            limit the 8.3 namespace on 16-bit platforms, it is highly
+            unlikely that any future development will be performed on
+            this platform.
+
+        (5) The $(LIBRARY_VERSION) tag has been added to all non-static
+            libraries created on UNIX operating systems to alleviate
+            any future confusion for binary releases which utilize this
+            tag.  Again, it should be noted that this tag is only
+            utilized on non-static libraries, since more than one
+            version of the library may need to exist simultaneously
+            if multiple products are utilized.
+
+            Currently, only one HCL released library utilizes this tag:
+
+                ns/security/lib/fortcrypt/fort12.a
+                (e. g. - in this library, the tag has been set to '12')
+
+            Again, it should be noted that although this would
+            additionally limit the 8.3 namespace on 16-bit platforms,
+            it is highly unlikely that any future development will be
+            performed on this platform.
+
+        (6) The $(JDK_DEBUG_SUFFIX) extension has been added to all
+            library and program names to support debug versions of
+            Java programs (e. g. - java_g, javac_g, etc).
+
+            Once again, it should be noted that although this would
+            additionally limit the 8.3 namespace on 16-bit platforms,
+            it is highly unlikely that any future Java development
+            will be performed on this platform.
+
+        (7) Most (if not all) default definitions for java have been
+            encapsulated within their own file, jdk.mk, which is
+            always included by default in ns/coreconf/config.mk.
+            However, the definitions within this file are only ever
+            activated if NS_USE_JDK has been set to be 1.
+
+
+        (8) Two perl scripts (jniregen.pl and outofdate.pl) have been
+            added to the system to foster a more robust development
+            environment for composing Java and JNI programs
+            utilizing the ns/coreconf build system.  Both of these
+            perl scripts are related to resolving dependencies which
+            can not be accomplished through normal makefile dependencies.
+
+        (9) This file, README, was created in an attempt to allow
+            developers who have familiarity with ns/coreconf a simple
+            roadmap for what has changed, as well as a top-level view of
+            what comprises ns/coreconf.  This file was written in
+            ASCII (rather than HTML) primarily to promote simple
+            paginated printing.
+
+OVERVIEW of "config.mk":
+
+    This file contains the configuration information necessary to
+    build each "Core Components" source module:
+
+        include file name       Purpose
+        ===================     =======================================
+        arch.mk                 source and release <architecture> tags
+
+        command.mk              default command macros 
+				(NOTE: may be overridden in $(OS_CONFIG).mk)
+
+        $(OS_CONFIG).mk         <architecture>-specific macros
+                                (dependent upon <architecture> tags)
+
+        tree.mk                 release <tree> tags 
+				(dependent upon <architecture> tags)
+
+        module.mk               source and release <component> tags 
+				(NOTE:  A component is also called a module 
+				or a subsystem.  This file is dependent upon
+                                $(MODULE) being defined on the command
+                                line, as an environment variable, or in
+                                individual makefiles, or more
+                                appropriately, manifest.mn)
+
+        version.mk              release <version> tags 
+				(dependent upon $(MODULE) being defined on 
+				the command line, as an environment variable, 
+				or in individual makefiles, or more
+                                appropriately, manifest.mn)
+
+        location.mk             macros to figure out binary code location
+                                (dependent upon <platform> tags)
+
+        source.mk               <component>-specific source path
+                                (dependent upon <user_source_tree>,
+                                <source_component>, <version>, and
+                                <platform> tags)
+
+        headers.mk              include switch for support header files 
+				(dependent upon <tree>, <component>, <version>,
+                                and <platform> tags)
+
+        prefix.mk               compute program prefixes
+
+        suffix.mk               compute program suffixes 
+				(dependent upon <architecture> tags)
+
+        jdk.mk                  define JDK 
+				(dependent upon <architecture>,
+                                <source>, and <suffix> tags)
+
+        ruleset.mk              Master "Core Components" rule set
+                                (should always be the last file
+                                included by config.mk)
+
+
+
+OVERVIEW of "rules.mk":
+
+    The "rules.mk" file consists of four sections.  The first section
+    contains the "master" build rules for all binary releases.  While
+    this section can (and should) largely be thought of as "language"
+    independent, it does utilize the "perl" scripting language to
+    perform both the "import" and "release" of binary modules.
+
+    The rules which dwell in this section and their purpose:
+
+
+        CATEGORY/rule::         Purpose
+        ===================     =======================================
+
+        GENERAL
+        -------
+        all::                   "default" all-encompassing rule which
+                                performs "export libs program install"
+
+        export::                recursively copy specified
+                                cross-platform header files to the
+                                $(SOURCE_XPHEADERS_DIR) directory;
+                                recursively copy specified
+                                machine-dependent header files to the
+                                $(SOURCE_MDHEADERS_DIR) directory;
+                                although all rules can be written to
+                                repetively "chain" into other sections,
+                                this rule is the most commonly used
+                                rule to "chain" into other sections
+                                such as Java providing a simple
+                                mechanism which allows no need for
+                                developers to memorize specialized
+                                rules
+
+        libs::                  recursively build
+                                static (archival) $(LIBRARY), shared
+                                (dynamic link) $(SHARED_LIBRARY),
+                                and/or import $(IMPORT_LIBRARY)
+                                libraries
+
+        program::               recursively build $(PROGRAM)
+                                executable
+
+        install::               recursively copy all libraries to
+                                $(SOURCE_LIB_DIR) directory;
+                                recursively copy all executables to
+                                $(SOURCE_BIN_DIR) directory
+
+        clean::                 remove all files specified in the
+                                $(ALL_TRASH) variable
+
+        clobber::               synonym for "clean::" rule
+
+        realclean::             remove all files specified by
+                                $(wildcard *.OBJ), dist, and in
+                                the $(ALL_TRASH) variable
+
+        clobber_all::           synonym for "realclean::" rule
+
+
+        RELEASE
+        -------
+        release_clean::         remove all files from the
+                                $(SOURCE_RELEASE_PREFIX) directory
+
+        release::               place specified VERSION of the
+                                binary release in the appropriate
+                                $(RELEASE_TREE) directory
+
+        release_export::        recursively copy specified
+                                cross-platform header files to the
+                                $(SOURCE_XPHEADERS_DIR)/include
+                                directory
+
+        release_md::            recursively copy all libraries to
+                                $(SOURCE_RELEASE_PREFIX)/
+                                $(SOURCE_RELEASE_LIB_DIR) directory;
+                                recursively copy all executables to
+                                $(SOURCE_RELEASE_PREFIX)/
+                                $(SOURCE_RELEASE_BIN_DIR) directory
+
+
+        TOOLS and AUTOMATION
+        --------------------
+        platform::              tool used to display the platform name
+                                as composed within the "arch.mk" file
+
+        autobuild::             automation rule used by "Bonsai" and
+                                "Tinderbox" to automatically generate
+                                binary releases on various platforms
+
+        check::                 automation tool used to run the
+                                "regress" and "reporter" tools 
+                                on various regression test suites
+
+    The second section of "rules.mk" primarily contains several
+    "language" dependent build rules for binary releases.  These are
+    generally "computed" rules (created on the "fly"), and include
+    rules used by "C", "C++", assembly, the preprocessor, perl, and
+    the shell.
+
+    The rules which dwell in this section and their purpose:
+
+
+        CATEGORY/rule::                   Purpose
+        ===================               =============================
+
+        LIBRARIES
+        ---------
+        $(LIBRARY):                       build the static library
+                                          specified by the $(LIBRARY)
+                                          variable
+
+        $(IMPORT_LIBRARY):                build the import library
+                                          specified by the
+                                          $(IMPORT_LIBRARY) variable
+
+        $(SHARED_LIBRARY):                build the shared
+                                          (dynamic link) library
+                                          specified by the
+                                          $(SHARED_LIBRARY) variable
+
+
+        PROGRAMS
+        --------
+        $(PROGRAM):                       build the binary executable
+                                          specified by the $(PROGRAM)
+                                          rule
+
+        $(OBJDIR)/
+        $(PROG_PREFIX)%.pure:             build the "purified" binary
+                                          executable specified by this
+                                          rule
+
+
+        OBJECTS
+        -------
+        $(OBJDIR)/
+        $(PROG_PREFIX)%$(OBJ_SUFFIX):     build the object file
+                                          associated with the
+                                          makefile rule dependency:
+
+                                              %.c   = C file
+                                              %.cpp = C++ file
+                                              %.cc  = C++ file
+                                              %.s   = assembly file
+                                              %.S   = assembly file
+
+        $(OBJDIR)/
+        $(PROG_PREFIX)%:                  (NOTE: deprecated rule)
+                                          build the object file
+                                          associated with the
+                                          makefile rule dependency:
+
+                                              %.cpp = C++ file
+
+        MISCELLANEOUS
+        -------------
+        %.i:                              build the preprocessor file
+                                          associated with the
+                                          makefile rule dependency:
+
+                                              %.c   = C file
+                                              %.cpp = C++ file
+
+        %:                                process the specified file
+                                          using the method associated
+                                          with the makefile rule
+                                          dependency:
+
+                                              %.pl = perl script
+                                              %.sh = shell script
+
+        alltags:                          tool used to recursively
+                                          create a "ctags"-style
+                                          file for reference
+
+    The third section of "rules.mk' primarily contains several JAVA
+    "language" build rules for binary releases.  These are also
+    generally "computed" rules (created on the "fly").
+
+    The rules which dwell in this section and their purpose:
+
+
+        CATEGORY/rule::                   Purpose
+        ===================               =============================
+        $(JAVA_DESTPATH)::                create directory specified
+                                          as the Java destination path
+                                          for where classes are
+                                          deposited
+
+        $(JAVA_DESTPATH)/$(PACKAGE)::     create directories specified
+                                          within the $(PACKAGE)
+                                          variable
+
+        $(JMCSRCDIR)::                    create directory specified
+                                          as the JMC destination path
+
+        $(JRI_HEADER_CFILES):             used to generate/regenerate
+                                          JRI header files for "C"
+
+        $(JRI_STUB_CFILES):               used to generate/regenerate
+                                          JRI stub files for "C"
+
+        $(JNI_HEADERS):                   used to generate/regenerate
+                                          JNI header files for "C"
+
+    The fourth section of "rules.mk" primarily contains miscellaneous
+    build rules for binary releases.  Many of these rules are here to
+    create new subdirectories, manage dependencies, and/or override
+    standard gmake "Makefile" rules.
+
+    The rules which dwell in this section and their purpose:
+
+
+        CATEGORY/rule::                   Purpose
+        ===================               =============================
+
+        $(SOURCE_XP_DIR)/
+        release/include::                 create directory used to
+                                          house "C" header files
+                                          contained in a release
+
+        .DEFAULT:                         standard gmake rule
+
+        .SUFFIXES:                        standard gmake rule
+
+        .PRECIOUS:                        standard gmake rule
+
+        .PHONY:                           standard gmake rule
+
diff --git a/security/nss/coreconf/RISCOS.mk b/security/nss/coreconf/RISCOS.mk
new file mode 100644
index 0000000000..f8d9e2f631
--- /dev/null
+++ b/security/nss/coreconf/RISCOS.mk
@@ -0,0 +1,22 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+LIB_SUFFIX  = a
+DLL_SUFFIX  = so
+AR          = ar cr $@
+LDOPTS     += -L$(SOURCE_LIB_DIR)
+MKSHLIB     = $(CC) $(DSO_LDOPTS) -Wl,-soname -Wl,$(@:$(OBJDIR)/%.so=%.so)
+
+OS_RELEASE  =
+OS_TARGET   = RISCOS
+
+DSO_CFLAGS  = -fPIC
+DSO_LDOPTS  = -shared
+
+ifdef BUILD_OPT
+	OPTIMIZER = -O3
+endif
diff --git a/security/nss/coreconf/ReliantUNIX.mk b/security/nss/coreconf/ReliantUNIX.mk
new file mode 100644
index 0000000000..8af2c3dba6
--- /dev/null
+++ b/security/nss/coreconf/ReliantUNIX.mk
@@ -0,0 +1,58 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = cc
+
+ifdef NS_USE_GCC
+	## gcc-2.7.2 homebrewn
+	CC          = gcc
+	CCC         = g++
+	AS          = $(CC)
+	ASFLAGS     += -x assembler-with-cpp
+	LD          = gld
+	ODD_CFLAGS  = -pipe -Wall -Wno-format -Wno-switch
+	ifdef BUILD_OPT
+		OPTIMIZER += -O6
+	endif
+	MKSHLIB     = $(LD)
+	MKSHLIB    += -G -h $(@:$(OBJDIR)/%.so=%.so)
+	DSO_LDOPTS += -G -Xlinker -Blargedynsym
+else
+	## native compiler (CDS++ 1.0)
+#	CC   = /usr/bin/cc
+	CC   = cc
+	CCC  = /usr/bin/CC
+	AS   = /usr/bin/cc
+	ODD_CFLAGS  = 
+	ifdef BUILD_OPT
+		OPTIMIZER += -O -F Olimit,4000
+	endif
+	MKSHLIB     = $(CC)
+	MKSHLIB    += -G -h $(@:$(OBJDIR)/%.so=%.so)
+	DSO_LDOPTS += -G -W l,-Blargedynsym
+endif
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+NOSUCHFILE  = /sni-rm-f-sucks
+ODD_CFLAGS += -DSVR4 -DSNI -DRELIANTUNIX
+CPU_ARCH    = mips
+RANLIB      = /bin/true
+
+# For purify
+NOMD_OS_CFLAGS += $(ODD_CFLAGS)
+
+# we do not have -MDupdate ...
+OS_CFLAGS   += $(NOMD_OS_CFLAGS)
+OS_LIBS     += -lsocket -lnsl -lresolv -lgen -ldl -lc /usr/ucblib/libucb.a
+
+ifdef DSO_BACKEND
+	DSO_LDOPTS += -h $(DSO_NAME)
+endif
diff --git a/security/nss/coreconf/ReliantUNIX5.4.mk b/security/nss/coreconf/ReliantUNIX5.4.mk
new file mode 100644
index 0000000000..f52cb7f39b
--- /dev/null
+++ b/security/nss/coreconf/ReliantUNIX5.4.mk
@@ -0,0 +1,5 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+include $(CORE_DEPTH)/coreconf/ReliantUNIX.mk
diff --git a/security/nss/coreconf/SCOOS5.0.mk b/security/nss/coreconf/SCOOS5.0.mk
new file mode 100644
index 0000000000..5d73220a75
--- /dev/null
+++ b/security/nss/coreconf/SCOOS5.0.mk
@@ -0,0 +1,6 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/SCO_SV3.2.mk
diff --git a/security/nss/coreconf/SCO_SV3.2.mk b/security/nss/coreconf/SCO_SV3.2.mk
new file mode 100644
index 0000000000..813603f265
--- /dev/null
+++ b/security/nss/coreconf/SCO_SV3.2.mk
@@ -0,0 +1,57 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = cc
+
+CC         = cc
+OS_CFLAGS += -b elf -KPIC
+CCC        = g++
+CCC       += -b elf -DPRFSTREAMS_BROKEN -I/usr/local/lib/g++-include
+# CCC      = $(CORE_DEPTH)/build/hcpp
+# CCC     += +.cpp +w
+RANLIB     = /bin/true
+
+#
+# -DSCO_PM - Policy Manager AKA: SCO Licensing
+# -DSCO - Changes to Netscape source (consistent with AIX, LINUX, etc..)
+# -Dsco - Needed for /usr/include/X11/*
+#
+OS_CFLAGS   += -DSCO_SV -DSYSV -D_SVID3 -DHAVE_STRERROR -DSW_THREADS -DSCO_PM -DSCO -Dsco
+#OS_LIBS     += -lpmapi -lsocket -lc
+MKSHLIB      = $(LD)
+MKSHLIB     += $(DSO_LDOPTS)
+XINC         = /usr/include/X11
+MOTIFLIB    += -lXm
+INCLUDES    += -I$(XINC)
+CPU_ARCH     = x86
+GFX_ARCH     = x
+ARCH         = sco
+LOCALE_MAP   = $(CORE_DEPTH)/cmd/xfe/intl/sco.lm
+EN_LOCALE    = C
+DE_LOCALE    = de_DE.ISO8859-1
+FR_LOCALE    = fr_FR.ISO8859-1
+JP_LOCALE    = ja
+SJIS_LOCALE  = ja_JP.SJIS
+KR_LOCALE    = ko_KR.EUC
+CN_LOCALE    = zh
+TW_LOCALE    = zh
+I2_LOCALE    = i2
+LOC_LIB_DIR  = /usr/lib/X11
+NOSUCHFILE   = /solaris-rm-f-sucks
+BSDECHO      = /bin/echo
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+#
+# These defines are for building unix plugins
+#
+BUILD_UNIX_PLUGINS  = 1
+#DSO_LDOPTS         += -b elf -G -z defs
+DSO_LDOPTS         += -b elf -G
diff --git a/security/nss/coreconf/SunOS4.1.3_U1.mk b/security/nss/coreconf/SunOS4.1.3_U1.mk
new file mode 100644
index 0000000000..edca215be3
--- /dev/null
+++ b/security/nss/coreconf/SunOS4.1.3_U1.mk
@@ -0,0 +1,28 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = cc
+
+INCLUDES += -I/usr/dt/include -I/usr/openwin/include -I/home/motif/usr/include
+
+# SunOS 4 _requires_ that shared libs have a version number.
+# XXX FIXME: Version number should use NSPR_VERSION_NUMBER?
+DLL_SUFFIX = so.1.0
+CC         = gcc
+RANLIB     = ranlib
+CPU_ARCH   = sparc
+
+# Purify doesn't like -MDupdate
+NOMD_OS_CFLAGS += -Wall -Wno-format -Wno-switch -DSUNOS4
+OS_CFLAGS      += $(DSO_CFLAGS) $(NOMD_OS_CFLAGS)
+MKSHLIB         = $(LD)
+MKSHLIB        += $(DSO_LDOPTS)
+NOSUCHFILE      = /solaris-rm-f-sucks
+DSO_LDOPTS      =
+
+# -fPIC generates position-independent code for use in a shared library.
+DSO_CFLAGS += -fPIC
diff --git a/security/nss/coreconf/SunOS5.mk b/security/nss/coreconf/SunOS5.mk
new file mode 100644
index 0000000000..024c8a7041
--- /dev/null
+++ b/security/nss/coreconf/SunOS5.mk
@@ -0,0 +1,142 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+# Sun's WorkShop defines v8, v8plus and v9 architectures.
+# gcc on Solaris defines v8 and v9 "cpus".  
+# gcc's v9 is equivalent to Workshop's v8plus.
+# gcc's -m64 is equivalent to Workshop's v9
+
+ifeq ($(USE_64), 1)
+  ifdef NS_USE_GCC
+      ARCHFLAG=-m64
+  else
+      ifeq ($(OS_TEST),i86pc)
+        ARCHFLAG=-xarch=amd64
+      else
+        ARCHFLAG=-xarch=v9
+      endif
+  endif
+else
+  ifneq ($(OS_TEST),i86pc)
+    ifdef NS_USE_GCC
+      ARCHFLAG=-mcpu=v9
+    else
+      ARCHFLAG=-xarch=v8plus
+    endif
+  endif
+endif
+
+DEFAULT_COMPILER = cc
+
+ifdef NS_USE_GCC
+	CC         = gcc
+	OS_CFLAGS += -Wall -Wno-format -Werror-implicit-function-declaration -Wno-switch
+	OS_CFLAGS += -D__EXTENSIONS__
+	CCC        = g++
+	CCC       += -Wall -Wno-format
+	ASFLAGS	  += -x assembler-with-cpp
+	OS_CFLAGS += $(NOMD_OS_CFLAGS) $(ARCHFLAG)
+	ifdef BUILD_OPT
+	    OPTIMIZER = -O2
+	    # Enable this for accurate dtrace profiling
+	    # OPTIMIZER += -mno-omit-leaf-frame-pointer -fno-omit-frame-pointer
+	endif
+else
+	CC         = cc
+	CCC        = CC
+	ASFLAGS   += -Wa,-P
+	OS_CFLAGS += $(NOMD_OS_CFLAGS) $(ARCHFLAG)
+	ifndef BUILD_OPT
+		OS_CFLAGS  += -xs
+	else
+		OPTIMIZER = -xO4
+	endif
+	ifdef USE_TCOV
+		CC += -xprofile=tcov
+		CCC += -xprofile=tcov
+	endif
+endif
+
+RANLIB      = echo
+CPU_ARCH    = sparc
+OS_DEFINES += -DSVR4 -DSYSV -D__svr4 -D__svr4__ -DSOLARIS -D_REENTRANT
+
+ifeq ($(OS_TEST),i86pc)
+ifeq ($(USE_64),1)
+    CPU_ARCH		= x86_64
+else
+    CPU_ARCH		= x86
+    OS_DEFINES		+= -Di386
+endif
+endif
+
+# Purify doesn't like -MDupdate
+NOMD_OS_CFLAGS += $(DSO_CFLAGS) $(OS_DEFINES) $(SOL_CFLAGS)
+
+MKSHLIB  = $(CC) $(DSO_LDOPTS) $(RPATH)
+ifdef NS_USE_GCC
+ifeq (GNU,$(findstring GNU,$(shell `$(CC) -print-prog-name=ld` -v 2>&1)))
+	GCC_USE_GNU_LD = 1
+endif
+endif
+ifdef MAPFILE
+ifdef NS_USE_GCC
+ifdef GCC_USE_GNU_LD
+    MKSHLIB += -Wl,--version-script,$(MAPFILE)
+else
+    MKSHLIB += -Wl,-M,$(MAPFILE)
+endif
+else
+    MKSHLIB += -M $(MAPFILE)
+endif
+endif
+PROCESS_MAP_FILE = grep -v ';-' $< | \
+         sed -e 's,;+,,' -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,;,' > $@
+
+# ld options:
+# -G: produce a shared object
+# -z defs: no unresolved symbols allowed
+ifdef NS_USE_GCC
+ifeq ($(USE_64), 1)
+	DSO_LDOPTS += -m64
+endif
+	DSO_LDOPTS += -shared -h $(notdir $@)
+else
+ifeq ($(USE_64), 1)
+	ifeq ($(OS_TEST),i86pc)
+	    DSO_LDOPTS +=-xarch=amd64
+	else
+	    DSO_LDOPTS +=-xarch=v9
+	endif
+endif
+	DSO_LDOPTS += -G -h $(notdir $@)
+endif
+DSO_LDOPTS += -z combreloc -z defs -z ignore
+
+# -KPIC generates position independent code for use in shared libraries.
+# (Similarly for -fPIC in case of gcc.)
+ifdef NS_USE_GCC
+	DSO_CFLAGS += -fPIC
+else
+	DSO_CFLAGS += -KPIC
+endif
+
+NOSUCHFILE   = /solaris-rm-f-sucks
+
+ifeq ($(BUILD_SUN_PKG), 1)
+# The -R '$ORIGIN' linker option instructs this library to search for its
+# dependencies in the same directory where it resides.
+ifeq ($(USE_64), 1)
+RPATH = -R '$$ORIGIN:/usr/lib/mps/secv1/64:/usr/lib/mps/64'
+else
+RPATH = -R '$$ORIGIN:/usr/lib/mps/secv1:/usr/lib/mps'
+endif
+else
+RPATH = -R '$$ORIGIN'
+endif
+
+OS_LIBS += -lthread -lnsl -lsocket -lposix4 -ldl -lc
diff --git a/security/nss/coreconf/UNIX.mk b/security/nss/coreconf/UNIX.mk
new file mode 100644
index 0000000000..59dbf7bcbe
--- /dev/null
+++ b/security/nss/coreconf/UNIX.mk
@@ -0,0 +1,60 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+XP_DEFINE  += -DXP_UNIX
+LIB_SUFFIX  = a
+DLL_SUFFIX  = so
+AR          = ar cr $@
+LDOPTS     += -L$(SOURCE_LIB_DIR)
+
+ifdef BUILD_OPT
+	OPTIMIZER  += -O
+	DEFINES    += -UDEBUG -DNDEBUG
+else
+	OPTIMIZER  += -g
+	DEFINES    += -DDEBUG -UNDEBUG
+endif
+
+ifdef BUILD_TREE
+NSINSTALL_DIR  = $(BUILD_TREE)/nss
+NSINSTALL      = $(BUILD_TREE)/nss/nsinstall
+else
+NSINSTALL_DIR  = $(CORE_DEPTH)/coreconf/nsinstall
+NSINSTALL      = $(NSINSTALL_DIR)/$(OBJDIR_NAME)/nsinstall
+endif
+
+####################################################################
+#
+# One can define the makefile variable NSDISTMODE to control
+# how files are published to the 'dist' directory.  If not
+# defined, the default is "install using relative symbolic
+# links".  The two possible values are "copy", which copies files
+# but preserves source mtime, and "absolute_symlink", which
+# installs using absolute symbolic links.
+#   - THIS IS NOT PART OF THE NEW BINARY RELEASE PLAN for 9/30/97
+#   - WE'RE KEEPING IT ONLY FOR BACKWARDS COMPATIBILITY
+####################################################################
+
+ifeq ($(NSDISTMODE),copy)
+	# copy files, but preserve source mtime
+	INSTALL  = $(NSINSTALL)
+	INSTALL += -t
+else
+	ifeq ($(NSDISTMODE),absolute_symlink)
+		# install using absolute symbolic links
+		INSTALL  = $(NSINSTALL)
+		INSTALL += -L `pwd`
+	else
+		# install using relative symbolic links
+		INSTALL  = $(NSINSTALL)
+		INSTALL += -R
+	endif
+endif
+
+define MAKE_OBJDIR
+if test ! -d $(@D); then $(NSINSTALL) -D $(@D); fi
+endef
+
+include $(CORE_DEPTH)/coreconf/Werror.mk
diff --git a/security/nss/coreconf/UNIXWARE2.1.mk b/security/nss/coreconf/UNIXWARE2.1.mk
new file mode 100644
index 0000000000..f1cf8c956c
--- /dev/null
+++ b/security/nss/coreconf/UNIXWARE2.1.mk
@@ -0,0 +1,29 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Config stuff for SCO Unixware 2.1
+#
+
+include $(CORE_DEPTH)/coreconf/UNIX.mk
+
+DEFAULT_COMPILER = $(CORE_DEPTH)/build/hcc
+
+CC         = $(CORE_DEPTH)/build/hcc
+CCC         = $(CORE_DEPTH)/build/hcpp
+RANLIB      = true
+OS_CFLAGS   = -KPIC -DSVR4 -DSYSV -DUNIXWARE
+MKSHLIB     = $(LD)
+MKSHLIB    += $(DSO_LDOPTS)
+DSO_LDOPTS += -G
+CPU_ARCH    = x86
+ARCH        = sco
+NOSUCHFILE  = /solaris-rm-f-sucks
+ifdef MAPFILE
+# Add LD options to restrict exported symbols to those in the map file
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
diff --git a/security/nss/coreconf/WIN32.mk b/security/nss/coreconf/WIN32.mk
new file mode 100644
index 0000000000..f5db943cff
--- /dev/null
+++ b/security/nss/coreconf/WIN32.mk
@@ -0,0 +1,368 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Configuration common to all versions of Windows NT
+# and Windows 95
+#
+
+DEFAULT_COMPILER = cl
+
+ifdef NS_USE_GCC
+	CC           = gcc
+	CCC          = g++
+	LD           = ld
+	AR           = ar
+	AR          += cr $@
+	RANLIB       = ranlib
+	BSDECHO      = echo
+	RC           = windres.exe -O coff --use-temp-file
+	LINK_DLL      = $(CC) $(OS_DLLFLAGS) $(DLLFLAGS)
+else
+	CC           = cl
+	CCC          = cl
+	LD           = link
+        LDFLAGS += -nologo
+	AR           = lib
+	AR          += -nologo -OUT:$@
+	RANLIB       = echo
+	BSDECHO      = echo
+	RC           = rc.exe
+	MT           = mt.exe
+	# Check for clang-cl
+	CLANG_CL    := $(shell expr `$(CC) -? 2>&1 | grep -w clang | wc -l` \> 0)
+	# Determine compiler version
+	ifeq ($(CLANG_CL),1)
+	    # clang-cl pretends to be MSVC 2012.
+	    CC_VERSION  := 17.00.00.00
+	else
+	    CC_VERSION  := $(shell $(CC) 2>&1 | sed -ne \
+		's|.* \([0-9]\+\.[0-9]\+\.[0-9]\+\(\.[0-9]\+\)\?\).*|\1|p')
+	endif
+	# Change the dots to spaces.
+	_CC_VERSION_WORDS := $(subst ., ,$(CC_VERSION))
+	_CC_VMAJOR  := $(word 1,$(_CC_VERSION_WORDS))
+	_CC_VMINOR  := $(word 2,$(_CC_VERSION_WORDS))
+	_CC_RELEASE := $(word 3,$(_CC_VERSION_WORDS))
+	_CC_BUILD   := $(word 4,$(_CC_VERSION_WORDS))
+	_MSC_VER     = $(_CC_VMAJOR)$(_CC_VMINOR)
+	_MSC_VER_6   = 1200
+	# VC10 (2010) is 16.00.30319.01, VC10SP1 is 16.00.40219.01.
+	_MSC_VER_GE_10SP1 := $(shell expr $(_MSC_VER) \> 1600 \| \
+		$(_MSC_VER) = 1600 \& $(_CC_RELEASE) \>= 40219)
+	# VC11 (2012).
+	_MSC_VER_GE_11 := $(shell expr $(_MSC_VER) \>= 1700)
+	# VC12 (2013).
+	_MSC_VER_GE_12 := $(shell expr $(_MSC_VER) \>= 1800)
+	# VC14 (2015).
+	_MSC_VER_GE_14 := $(shell expr $(_MSC_VER) \>= 1900)
+	ifeq ($(_CC_VMAJOR),14)
+	    # -DYNAMICBASE is only supported on VC8SP1 or newer,
+	    # so be very specific here!
+	    # VC8 is 14.00.50727.42, VC8SP1 is 14.00.50727.762
+	    ifeq ($(_CC_RELEASE).$(_CC_BUILD),50727.42)
+		USE_DYNAMICBASE =
+	    else
+	    ifeq ($(_CC_RELEASE).$(_CC_BUILD),50727.762)
+		USE_DYNAMICBASE = 1
+	    else
+		_LOSER := $(error Unknown compiler version $(CC_VERSION))
+	    endif
+	    endif
+	endif
+	# if $(_CC_VMAJOR) >= 15
+	# NOTE: 'sort' sorts the words in lexical order, so this test works
+	# only if $(_CC_VMAJOR) is two digits.
+	ifeq ($(firstword $(sort $(_CC_VMAJOR) 15)),15)
+	    USE_DYNAMICBASE = 1
+	endif
+endif
+
+ifdef BUILD_TREE
+NSINSTALL_DIR  = $(BUILD_TREE)/nss
+else
+NSINSTALL_DIR  = $(CORE_DEPTH)/coreconf/nsinstall
+endif
+NSINSTALL      = nsinstall
+
+INSTALL      = $(NSINSTALL)
+GARBAGE     += $(OBJDIR)/vc20.pdb $(OBJDIR)/vc40.pdb
+XP_DEFINE   += -DXP_PC
+ifdef NS_USE_GCC
+LIB_SUFFIX   = a
+else
+LIB_SUFFIX   = lib
+endif
+DLL_SUFFIX   = dll
+
+define MAKE_OBJDIR
+if test ! -d $(@D); then mkdir -p $(@D); fi
+endef
+
+ifdef NS_USE_GCC
+    OS_CFLAGS += -mwindows
+    _GEN_IMPORT_LIB=-Wl,--out-implib,$(IMPORT_LIBRARY)
+    DLLFLAGS  += -mwindows -o $@ -shared -Wl,--export-all-symbols $(if $(IMPORT_LIBRARY),$(_GEN_IMPORT_LIB))
+    ifdef BUILD_OPT
+	ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
+		OPTIMIZER += -Os
+	else
+		OPTIMIZER += -O2
+	endif
+	DEFINES    += -UDEBUG -DNDEBUG
+    else
+	OPTIMIZER  += -g
+	DEFINES    += -DDEBUG -UNDEBUG
+    endif
+else # !NS_USE_GCC
+    WARNING_CFLAGS = -W3 -nologo -D_CRT_SECURE_NO_WARNINGS \
+                      -D_CRT_NONSTDC_NO_WARNINGS
+    OS_DLLFLAGS += -nologo -DLL -SUBSYSTEM:WINDOWS
+    ifndef NSS_ENABLE_WERROR
+        NSS_ENABLE_WERROR = 1
+    endif
+    ifeq ($(NSS_ENABLE_WERROR),1)
+        WARNING_CFLAGS += -WX
+    endif
+    ifeq ($(_MSC_VER),$(_MSC_VER_6))
+    ifndef MOZ_DEBUG_SYMBOLS
+	OS_DLLFLAGS += -PDB:NONE
+    endif
+    endif
+    ifdef USE_DYNAMICBASE
+	OS_DLLFLAGS += -DYNAMICBASE
+    endif
+    #
+    # Define USE_DEBUG_RTL if you want to use the debug runtime library
+    # (RTL) in the debug build.
+    # Define USE_STATIC_RTL if you want to use the static RTL.
+    #
+    ifdef USE_DEBUG_RTL
+	ifdef USE_STATIC_RTL
+		OS_CFLAGS += -MTd
+	else
+		OS_CFLAGS += -MDd
+	endif
+	OS_CFLAGS += -D_CRTDBG_MAP_ALLOC
+    else
+	ifdef USE_STATIC_RTL
+		OS_CFLAGS += -MT
+	else
+		OS_CFLAGS += -MD
+	endif
+    endif
+    ifdef BUILD_OPT
+	ifeq (11,$(ALLOW_OPT_CODE_SIZE)$(OPT_CODE_SIZE))
+		OPTIMIZER += -O1
+	else
+		OPTIMIZER += -O2
+	endif
+	DEFINES    += -UDEBUG -DNDEBUG
+	DLLFLAGS   += -OUT:$@
+	ifdef MOZ_DEBUG_SYMBOLS
+		ifdef MOZ_DEBUG_FLAGS
+			OPTIMIZER += $(MOZ_DEBUG_FLAGS) -Fd$(OBJDIR)/
+		else
+			OPTIMIZER += -Zi -Fd$(OBJDIR)/
+		endif
+		DLLFLAGS += -DEBUG -OPT:REF
+		LDFLAGS += -DEBUG -OPT:REF
+	endif
+    else
+	OPTIMIZER += -Zi -Fd$(OBJDIR)/ -Od
+	NULLSTRING :=
+	DEFINES    += -DDEBUG -UNDEBUG
+	DLLFLAGS   += -DEBUG -OUT:$@
+	LDFLAGS    += -DEBUG 
+ifeq ($(_MSC_VER),$(_MSC_VER_6))
+ifndef MOZ_DEBUG_SYMBOLS
+	LDFLAGS    += -PDB:NONE 
+endif
+endif
+	# Purify requires /FIXED:NO when linking EXEs.
+	LDFLAGS    += /FIXED:NO
+	# So the linker will find main in the gtestutil library
+	LDFLAGS    += -SUBSYSTEM:CONSOLE
+    endif
+ifneq ($(_MSC_VER),$(_MSC_VER_6))
+    # NSS has too many of these to fix, downgrade the warning
+    # Disable C4267: conversion from 'size_t' to 'type', possible loss of data
+    # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
+    # Disable C4018: 'expression' : signed/unsigned mismatch
+    # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+    OS_CFLAGS += -w44267 -w44244 -w44018 -w44312
+    ifeq ($(_MSC_VER_GE_12),1)
+	OS_CFLAGS += -FS
+    endif
+endif # !MSVC6
+endif # NS_USE_GCC
+
+ifdef USE_64
+DEFINES += -DWIN64
+else
+DEFINES += -DWIN32
+endif
+
+ifeq (,$(filter-out x386 x86_64,$(CPU_ARCH)))
+ifdef USE_64
+	DEFINES += -D_AMD64_
+	# Use subsystem 5.02 to allow running on Windows XP.
+	ifeq ($(_MSC_VER_GE_11),1)
+		LDFLAGS += -SUBSYSTEM:CONSOLE,5.02
+	endif
+	CPU_ARCH = x86_64
+else
+	DEFINES += -D_X86_
+	# VS2012 defaults to -arch:SSE2. Use -arch:IA32 to avoid requiring
+	# SSE2. Clang-cl gets confused by -arch:IA32, so don't add it.
+	# (See https://llvm.org/bugs/show_bug.cgi?id=24335)
+	# Use subsystem 5.01 to allow running on Windows XP.
+	ifeq ($(_MSC_VER_GE_11),1)
+		ifneq ($(CLANG_CL),1)
+			OS_CFLAGS += -arch:IA32
+		endif
+		LDFLAGS += -SUBSYSTEM:CONSOLE,5.01
+	endif
+	CPU_ARCH = x386
+endif
+endif
+ifeq ($(CPU_ARCH), ALPHA)
+	DEFINES += -D_ALPHA_=1
+endif
+
+ifdef MAPFILE
+ifndef NS_USE_GCC
+DLLFLAGS += -DEF:$(MAPFILE)
+endif
+endif
+# Change PROCESS to put the mapfile in the correct format for this platform
+PROCESS_MAP_FILE = cp $< $@
+
+
+#
+#  The following is NOT needed for the NSPR 2.0 library.
+#
+
+DEFINES += -D_WINDOWS
+
+# override default, which is ASFLAGS = CFLAGS
+ifdef NS_USE_GCC
+	AS	= $(CC)
+	ASFLAGS = $(INCLUDES)
+else
+ifdef USE_64
+	AS	= ml64.exe
+	ASFLAGS = -nologo -Cp -Sn -Zi $(INCLUDES)
+else
+	AS	= ml.exe
+	ASFLAGS = -nologo -Cp -Sn -Zi -coff -safeseh $(INCLUDES)
+endif
+endif
+
+# clear any CSTD and CXXSTD unless we're using GCC
+ifndef NS_USE_GCC
+        CSTD    =
+        CXXSTD  =
+endif
+
+#
+# override the definitions of RELEASE_TREE found in tree.mk
+#
+ifndef RELEASE_TREE
+    ifdef BUILD_SHIP
+	ifdef USE_SHIPS
+	    RELEASE_TREE = $(NTBUILD_SHIP)
+	else
+	    RELEASE_TREE = //redbuild/components
+	endif
+    else
+	RELEASE_TREE = //redbuild/components
+    endif
+endif
+
+#
+# override the definitions of IMPORT_LIB_PREFIX, LIB_PREFIX, and
+# DLL_PREFIX in prefix.mk
+#
+
+ifndef IMPORT_LIB_PREFIX
+    ifdef NS_USE_GCC
+	IMPORT_LIB_PREFIX = lib
+    else
+	IMPORT_LIB_PREFIX = $(NULL)
+    endif
+endif
+
+ifndef LIB_PREFIX
+    ifdef NS_USE_GCC
+	LIB_PREFIX = lib
+    else
+	LIB_PREFIX = $(NULL)
+    endif
+endif
+
+ifndef DLL_PREFIX
+    DLL_PREFIX =  $(NULL)
+endif
+
+#
+# override the definitions of various _SUFFIX symbols in suffix.mk
+#
+
+#
+# Object suffixes
+#
+ifndef OBJ_SUFFIX
+    ifdef NS_USE_GCC
+	OBJ_SUFFIX = .o
+    else
+	OBJ_SUFFIX = .obj
+    endif
+endif
+
+#
+# Assembler source suffixes
+#
+ifndef ASM_SUFFIX
+    ifdef NS_USE_GCC
+	ASM_SUFFIX = .s
+    else
+	ASM_SUFFIX = .asm
+    endif
+endif
+
+#
+# Library suffixes
+#
+
+ifndef IMPORT_LIB_SUFFIX
+    IMPORT_LIB_SUFFIX = .$(LIB_SUFFIX)
+endif
+
+ifndef DYNAMIC_LIB_SUFFIX_FOR_LINKING
+    DYNAMIC_LIB_SUFFIX_FOR_LINKING = $(IMPORT_LIB_SUFFIX)
+endif
+
+#
+# Program suffixes
+#
+ifndef PROG_SUFFIX
+    PROG_SUFFIX = .exe
+endif
+
+#
+# When the processor is NOT 386-based on Windows NT, override the
+# value of $(CPU_TAG).  For WinNT, 95, 16, not CE.
+#
+ifneq ($(CPU_ARCH),x386)
+    CPU_TAG = _$(CPU_ARCH)
+endif
+
+#
+# override the TARGETS defined in ruleset.mk, adding IMPORT_LIBRARY
+#
+ifndef TARGETS
+    TARGETS = $(LIBRARY) $(SHARED_LIBRARY) $(IMPORT_LIBRARY) $(PROGRAM)
+endif
diff --git a/security/nss/coreconf/WIN95.mk b/security/nss/coreconf/WIN95.mk
new file mode 100644
index 0000000000..fe5b43df31
--- /dev/null
+++ b/security/nss/coreconf/WIN95.mk
@@ -0,0 +1,15 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Config stuff for OS_TARGET=WIN95
+#
+
+include $(CORE_DEPTH)/coreconf/WIN32.mk
+
+DEFINES += -DWIN95
+
+# WINNT uses the lib prefix, Win95 doesn't
+NSPR31_LIB_PREFIX = $(NULL)
diff --git a/security/nss/coreconf/WINNT.mk b/security/nss/coreconf/WINNT.mk
new file mode 100644
index 0000000000..6052e5694f
--- /dev/null
+++ b/security/nss/coreconf/WINNT.mk
@@ -0,0 +1,20 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+# Config stuff for OS_TARGET=WINNT
+#
+
+include $(CORE_DEPTH)/coreconf/WIN32.mk
+
+DEFINES += -DWINNT
+
+#
+# Win NT needs -GT so that fibers can work
+#
+OS_CFLAGS += -GT
+
+# WINNT uses the lib prefix, Win95 doesn't
+NSPR31_LIB_PREFIX = lib
diff --git a/security/nss/coreconf/Werror.mk b/security/nss/coreconf/Werror.mk
new file mode 100644
index 0000000000..a569a497ce
--- /dev/null
+++ b/security/nss/coreconf/Werror.mk
@@ -0,0 +1,107 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This sets WARNING_CFLAGS for gcc-like compilers.
+
+ifndef CC_IS_CLANG
+  CC_IS_CLANG := $(and $(findstring clang, $(shell $(CC) --version 2>&1)), 1)
+  # Export CC_IS_CLANG to save a shell invocation when recursing.
+  export CC_IS_CLANG
+endif
+
+ifdef CC_IS_CLANG
+  # Clang claims GCC 4.2.1 compatibility, see GCC_VERSION
+  CC_IS_GCC = 1
+  # Export CC_IS_GCC to save a shell invocation when recursing.
+  export CC_IS_GCC
+endif
+
+ifndef CC_IS_GCC
+  CC_IS_GCC := $(shell $(CC) -x c -E -Wall -Werror /dev/null >/dev/null 2>&1 && echo 1)
+  # Export CC_IS_GCC to save a shell invocation when recursing.
+  export CC_IS_GCC
+endif
+
+ifndef CC_NAME
+  ifeq (1,$(CC_IS_GCC))
+    CC_NAME := $(shell $(CC) -? 2>&1 >/dev/null | sed -e 's/:.*//;1q')
+  else
+    CC_NAME := $(notdir $(CC))
+  endif
+  # Export CC_NAME to save a shell invocation when recursing.
+  export CC_NAME
+endif
+
+ifndef GCC_VERSION
+  ifeq (1,$(CC_IS_GCC))
+    GCC_VERSION := $(subst ., ,$(shell $(CC) -dumpversion || echo x.x.x))
+    # Export GCC_VERSION to save a shell invocation when recursing.
+    export GCC_VERSION
+  endif
+endif
+
+ifndef WARNING_CFLAGS
+  ifneq (1,$(CC_IS_GCC))
+    WARNING_CFLAGS = $(NULL)
+  else
+    # This tests to see if enabling the warning is possible before
+    # setting an option to disable it.
+    set_warning = $(shell $(CC) -x c -E -Werror -W$(1) /dev/null >/dev/null 2>&1 && echo -W$(2)$(1))
+    enable_warning = $(call set_warning,$(1),)
+    disable_warning = $(call set_warning,$(1),no-)
+
+    WARNING_CFLAGS = -Wall $(call enable_warning,shadow)
+    ifdef CC_IS_CLANG
+      # -Qunused-arguments : clang objects to arguments that it doesn't understand
+      #    and fixing this would require rearchitecture
+      WARNING_CFLAGS += -Qunused-arguments
+      # -Wno-parentheses-equality : because clang warns about macro expansions
+      WARNING_CFLAGS += $(call disable_warning,parentheses-equality)
+      ifdef BUILD_OPT
+        # clang is unable to handle glib's expansion of strcmp and similar for optimized
+        # builds, so ignore the resulting errors.
+        # See https://llvm.org/bugs/show_bug.cgi?id=20144
+        WARNING_CFLAGS += $(call disable_warning,array-bounds)
+        WARNING_CFLAGS += $(call disable_warning,unevaluated-expression)
+      endif
+    endif # if clang
+
+    ifndef NSS_ENABLE_WERROR
+      ifeq ($(OS_TARGET),Android)
+        # Android lollipop generates the following warning:
+        # error: call to 'sprintf' declared with attribute warning:
+        #   sprintf is often misused; please use snprintf [-Werror]
+        # So, just suppress -Werror entirely on Android
+        NSS_ENABLE_WERROR = 0
+        $(warning OS_TARGET is Android, disabling -Werror)
+      else
+        ifdef CC_IS_CLANG
+          # Clang reports its version as an older gcc, but it's OK
+          NSS_ENABLE_WERROR = 1
+        else
+          ifneq (,$(filter 4.8 4.9,$(word 1,$(GCC_VERSION)).$(word 2,$(GCC_VERSION))))
+            NSS_ENABLE_WERROR = 1
+          endif
+          ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+            NSS_ENABLE_WERROR = 1
+          endif
+        endif
+        ifndef NSS_ENABLE_WERROR
+          $(warning Unable to find gcc 4.8 or greater, disabling -Werror)
+          NSS_ENABLE_WERROR = 0
+        endif
+      endif
+    endif #ndef NSS_ENABLE_WERROR
+
+    ifeq ($(NSS_ENABLE_WERROR),1)
+      WARNING_CFLAGS += -Werror
+    else
+      # Old versions of gcc (< 4.8) don't support #pragma diagnostic in functions.
+      # Use this to disable use of that #pragma and the warnings it suppresses.
+      WARNING_CFLAGS += -DNSS_NO_GCC48
+    endif
+  endif
+  export WARNING_CFLAGS
+endif # ndef WARNING_CFLAGS
diff --git a/security/nss/coreconf/arch.mk b/security/nss/coreconf/arch.mk
new file mode 100644
index 0000000000..17e9faeac6
--- /dev/null
+++ b/security/nss/coreconf/arch.mk
@@ -0,0 +1,302 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" macros for getting the OS architecture     #
+# defines these symbols:
+# OS_ARCH	(from uname -r)
+# OS_TEST	(from uname -m)
+# OS_RELEASE	(from uname -v and/or -r)
+# OS_TARGET	User defined, or set to OS_ARCH
+# CPU_ARCH  	(from uname -m or -p, ONLY on WINNT)
+# OS_CONFIG	OS_TARGET + OS_RELEASE
+# OBJDIR_TAG    (uses GCOV_TAG, 64BIT_TAG)
+# OBJDIR_NAME
+#######################################################################
+
+#
+# Macros for getting the OS architecture
+#
+
+OS_ARCH := $(subst /,_,$(shell uname -s))
+
+#
+# Attempt to differentiate between sparc and x86 Solaris
+#
+
+OS_TEST := $(shell uname -m)
+ifeq ($(OS_TEST),i86pc)
+    OS_RELEASE := $(shell uname -r)_$(OS_TEST)
+else
+    OS_RELEASE := $(shell uname -r)
+endif
+
+
+#
+# Force the older BSD/OS versions to use the new arch name.
+#
+
+ifeq ($(OS_ARCH),BSD_386)
+    OS_ARCH = BSD_OS
+endif
+
+#
+# Catch Deterim if SVR4 is NCR or UNIXWARE
+#
+
+ifeq ($(OS_ARCH),UNIX_SV)
+    ifneq ($(findstring NCR, $(shell grep NCR /etc/bcheckrc | head -1 )),)
+	OS_ARCH = NCR
+    else
+	# Make UnixWare something human readable
+	OS_ARCH = UNIXWARE
+    endif
+
+    # Get the OS release number, not 4.2
+    OS_RELEASE := $(shell uname -v)
+endif
+
+ifeq ($(OS_ARCH),UNIX_System_V)
+    OS_ARCH	= NEC
+endif
+
+ifeq ($(OS_ARCH),AIX)
+    OS_RELEASE := $(shell uname -v).$(shell uname -r)
+endif
+
+#
+# SINIX changes name to ReliantUNIX with 5.43
+#
+
+ifeq ($(OS_ARCH),ReliantUNIX-N)
+    OS_ARCH    = ReliantUNIX
+    OS_RELEASE = 5.4
+endif
+
+ifeq ($(OS_ARCH),SINIX-N)
+    OS_ARCH    = ReliantUNIX
+    OS_RELEASE = 5.4
+endif
+
+#
+# Handle FreeBSD 2.2-STABLE, Linux 2.0.30-osfmach3, and
+#
+
+ifeq (,$(filter-out Linux FreeBSD ,$(OS_ARCH)))
+    OS_RELEASE := $(shell echo $(OS_RELEASE) | sed 's/-.*//')
+endif
+
+ifeq ($(OS_ARCH),Linux)
+    OS_RELEASE := $(subst ., ,$(OS_RELEASE))
+    ifneq ($(words $(OS_RELEASE)),1)
+	OS_RELEASE := $(word 1,$(OS_RELEASE)).$(word 2,$(OS_RELEASE))
+    endif
+    KERNEL = Linux
+    include $(CORE_DEPTH)/coreconf/Linux.mk
+endif
+
+# Since all uses of OS_ARCH that follow affect only userland, we can
+# merge other Glibc systems with Linux here.
+ifeq ($(OS_ARCH),GNU)
+    OS_ARCH = Linux
+    OS_RELEASE = 2.6
+    KERNEL = GNU
+endif
+ifeq ($(OS_ARCH),GNU_kFreeBSD)
+    OS_ARCH = Linux
+    OS_RELEASE = 2.6
+    KERNEL = FreeBSD
+endif
+
+#
+# For OS/2
+#
+ifeq ($(OS_ARCH),OS_2)
+    OS_ARCH = OS2
+    OS_RELEASE := $(shell uname -v)
+endif
+
+#######################################################################
+# Master "Core Components" macros for getting the OS target           #
+#######################################################################
+
+#
+# Note: OS_TARGET should be specified on the command line for gmake.
+# When OS_TARGET=WIN95 is specified, then a Windows 95 target is built.
+# The difference between the Win95 target and the WinNT target is that
+# the WinNT target uses Windows NT specific features not available
+# in Windows 95. The Win95 target will run on Windows NT, but (supposedly)
+# at lesser performance (the Win95 target uses threads; the WinNT target
+# uses fibers).
+#
+# If OS_TARGET is not specified, it defaults to $(OS_ARCH), i.e., no
+# cross-compilation, except on Windows, where it defaults to WIN95.
+#
+
+#
+# On WIN32, we also define the variable CPU_ARCH, if it isn't already.
+#
+ifndef CPU_ARCH
+    ifeq ($(OS_ARCH), WINNT)
+	CPU_ARCH := $(shell uname -p)
+	ifeq ($(CPU_ARCH),I386)
+	    CPU_ARCH = x386
+	endif
+    endif
+endif
+
+# If uname -s returns "Windows_NT", we assume that we are using
+# the uname.exe in MKS toolkit.
+#
+# The -r option of MKS uname only returns the major version number.
+# So we need to use its -v option to get the minor version number.
+# Moreover, it doesn't have the -p option, so we need to use uname -m.
+#
+ifeq ($(OS_ARCH), Windows_NT)
+    OS_ARCH = WINNT
+    OS_MINOR_RELEASE := $(shell uname -v)
+    # strip leading 0
+    OS_MINOR_RELEASE := $(patsubst 0%,%,$(OS_MINOR_RELEASE))
+    OS_RELEASE := $(OS_RELEASE).$(OS_MINOR_RELEASE)
+    ifndef CPU_ARCH
+	CPU_ARCH := $(shell uname -m)
+	#
+	# MKS's uname -m returns "586" on a Pentium machine.
+	#
+	ifneq (,$(findstring 86,$(CPU_ARCH)))
+	    CPU_ARCH = x386
+	endif
+    endif
+endif
+#
+# If uname -s returns "CYGWIN_NT-*", we assume that we are using
+# the uname.exe in the Cygwin tools.
+#
+ifeq (CYGWIN_NT,$(findstring CYGWIN_NT,$(OS_ARCH)))
+    OS_RELEASE := $(patsubst CYGWIN_NT-%,%,$(OS_ARCH))
+    OS_ARCH = WINNT
+    ifndef CPU_ARCH
+    ifeq (WOW64,$(findstring WOW64,$(OS_RELEASE)))
+        OS_RELEASE := $(patsubst %-WOW64,%,$(OS_RELEASE))
+    endif    
+	CPU_ARCH := $(shell uname -m)
+	#
+	# Cygwin's uname -m returns "i686" on a Pentium Pro machine.
+	#
+	ifneq (,$(findstring 86,$(CPU_ARCH)))
+	    CPU_ARCH = x386
+	endif
+    endif
+endif
+#
+# If uname -s returns "MINGW*_NT-*", we assume that we are using
+# the uname.exe in the MSYS toolkit.
+#
+ifneq (,$(filter MINGW32_NT-% MINGW64_NT-%,$(OS_ARCH)))
+    OS_RELEASE := $(patsubst MINGW64_NT-%,%,$(patsubst MINGW32_NT-%,%,$(OS_ARCH)))
+    OS_ARCH = WINNT
+    USE_MSYS = 1
+    ifndef CPU_ARCH
+	CPU_ARCH := $(shell uname -m)
+	#
+	# MSYS's uname -m returns "i686" on a Pentium Pro machine.
+	#
+	ifneq (,$(filter i%86,$(CPU_ARCH)))
+	    CPU_ARCH = x386
+	endif
+    endif
+endif
+
+ifeq ($(OS_TARGET),Android)
+#
+# this should be  configurable from the user
+#
+   OS_TEST := arm
+   OS_ARCH = Android
+   ifndef OS_TARGET_RELEASE
+	OS_TARGET_RELEASE := 8
+   endif
+endif
+
+ifndef OS_TARGET
+ifeq ($(OS_ARCH), WINNT)
+    OS_TARGET = WIN95
+else
+    OS_TARGET = $(OS_ARCH)
+endif
+endif
+
+ifeq ($(OS_TARGET), WIN95)
+    OS_RELEASE = 4.0
+endif
+
+ifdef OS_TARGET_RELEASE
+    OS_RELEASE = $(OS_TARGET_RELEASE)
+endif
+
+#
+# This variable is used to get OS_CONFIG.mk.
+#
+
+OS_CONFIG = $(OS_TARGET)$(OS_RELEASE)
+
+#
+# OBJDIR_TAG depends on the predefined variable BUILD_OPT,
+# to distinguish between debug and release builds.
+#
+
+ifeq ($(USE_GCOV), 1)
+    GCOV_TAG = _GCOV
+else
+    GCOV_TAG =
+endif
+ifeq ($(USE_64), 1)
+    64BIT_TAG = _64
+else
+    64BIT_TAG =
+endif
+OBJDIR_TAG_BASE=$(GCOV_TAG)$(64BIT_TAG)
+
+ifdef BUILD_OPT
+    OBJDIR_TAG = $(OBJDIR_TAG_BASE)_OPT
+else
+    ifdef BUILD_IDG
+	OBJDIR_TAG = $(OBJDIR_TAG_BASE)_IDG
+    else
+	OBJDIR_TAG = $(OBJDIR_TAG_BASE)_DBG
+    endif
+endif
+
+#
+# The following flags are defined in the individual $(OS_CONFIG).mk
+# files.
+#
+# CPU_TAG is defined if the CPU is not the most common CPU.
+# COMPILER_TAG is defined if the compiler is not the default compiler.
+# IMPL_STRATEGY may be defined too.
+#
+
+ifdef CROSS_COMPILE
+    OBJDIR_NAME_COMPILER =
+else
+    OBJDIR_NAME_COMPILER = $(COMPILER_TAG)
+endif
+OBJDIR_NAME_BASE = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(OBJDIR_NAME_COMPILER)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG)
+OBJDIR_NAME = $(OBJDIR_NAME_BASE).OBJ
+
+
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ifndef BUILD_OPT
+#
+# Define USE_DEBUG_RTL if you want to use the debug runtime library
+# (RTL) in the debug build
+#
+ifdef USE_DEBUG_RTL
+    OBJDIR_NAME = $(OBJDIR_NAME_BASE).OBJD
+endif
+endif
+endif
+
+MK_ARCH = included
diff --git a/security/nss/coreconf/check_cc.py b/security/nss/coreconf/check_cc.py
new file mode 100644
index 0000000000..d0736af7d6
--- /dev/null
+++ b/security/nss/coreconf/check_cc.py
@@ -0,0 +1,27 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+import sys
+
+def main():
+    if sys.platform == 'win32' or len(sys.argv) < 2:
+        print(0)
+    else:
+        cc = os.environ.get('CC', 'cc')
+        try:
+            if sys.argv[1] == "cc":
+                cc_output = subprocess.check_output(
+                    [cc, '--version'], universal_newlines=True)
+                cc_is_arg = "cc" in cc_output and not ("gcc" in cc_output)
+            else:
+                cc_is_arg = sys.argv[1] in subprocess.check_output(
+                  [cc, '--version'], universal_newlines=True)
+        except OSError:
+            # We probably just don't have CC/cc.
+            cc_is_arg = False
+        print(int(cc_is_arg))
+
+if __name__ == '__main__':
+    main()
+
diff --git a/security/nss/coreconf/command.mk b/security/nss/coreconf/command.mk
new file mode 100644
index 0000000000..a892520568
--- /dev/null
+++ b/security/nss/coreconf/command.mk
@@ -0,0 +1,41 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" default command macros;                    #
+# can be overridden in <arch>.mk                                      #
+#######################################################################
+
+AS            = $(CC)
+ASFLAGS      += $(CFLAGS)
+CCF           = $(CC) $(CFLAGS)
+LINK_DLL      = $(LD) $(OS_DLLFLAGS) $(DLLFLAGS) $(XLDFLAGS)
+CFLAGS        = $(OPTIMIZER) $(OS_CFLAGS) $(WARNING_CFLAGS) $(XP_DEFINE) \
+                $(DEFINES) $(INCLUDES) $(XCFLAGS)
+CSTD          = -std=c99
+CXXSTD        = -std=c++11
+PERL          = perl
+RANLIB        = echo
+TAR           = /bin/tar
+#
+# For purify
+#
+NOMD_CFLAGS  += $(OPTIMIZER) $(NOMD_OS_CFLAGS) $(XP_DEFINE) $(DEFINES) \
+		$(INCLUDES) $(XCFLAGS)
+
+# Optimization of code for size
+# OPT_CODE_SIZE
+# =1: The code can be optimized for size.
+#     The code is actually optimized for size only if ALLOW_OPT_CODE_SIZE=1
+#     in a given source code directory (in manifest.mn)
+# =0: Never optimize the code for size.
+#
+# Default value = 0 
+# Can be overridden from the make command line.
+ifndef OPT_CODE_SIZE
+OPT_CODE_SIZE = 0
+endif
+
+MK_COMMAND = included
diff --git a/security/nss/coreconf/config.gypi b/security/nss/coreconf/config.gypi
new file mode 100644
index 0000000000..85c8d36db3
--- /dev/null
+++ b/security/nss/coreconf/config.gypi
@@ -0,0 +1,683 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'variables': {
+    'module%': '',
+    'variables': {
+      'variables': {
+        'variables': {
+          'python%': 'python',
+        },
+        # chromium uses pymod_do_main, but gyp doesn't set a sensible
+        # Python sys.path (gyp_chromium does).
+        'python%': '<(python)',
+        'host_arch%': '<!("<(python)" <(DEPTH)/coreconf/detect_host_arch.py)',
+      },
+      'python%': '<(python)',
+      'host_arch%': '<(host_arch)',
+      'conditions': [
+        ['OS=="android"', {
+          'target_arch%': 'arm',
+        }, 'OS=="ios"', {
+          'target_arch%': 'arm64',
+        }, {
+          # Default architecture we're building for is the architecture we're
+          # building on.
+          'target_arch%': '<(host_arch)',
+        }],
+        ['OS=="linux"', {
+          # FIPS-140 LOWHASH
+          'freebl_name': 'freeblpriv3',
+        }, {
+          'freebl_name': 'freebl3',
+        }],
+        ['OS=="mac"', {
+          'use_system_sqlite%': 1,
+        },{
+          'use_system_sqlite%': 0,
+        }],
+        ['OS=="mac" or OS=="ios" or OS=="solaris" or OS=="win"', {
+          'cc_use_gnu_ld%': 0,
+        }, {
+          'cc_use_gnu_ld%': 1,
+        }],
+        ['OS=="win"', {
+          'use_system_zlib%': 0,
+          'nspr_libs%': ['libnspr4.lib', 'libplc4.lib', 'libplds4.lib'],
+          'zlib_libs%': [],
+          #TODO
+          'moz_debug_flags%': '',
+          'dll_prefix': '',
+          'dll_suffix': 'dll',
+        }, {
+          'use_system_zlib%': 1,
+          'nspr_libs%': ['-lplds4', '-lplc4', '-lnspr4'],
+          'zlib_libs%': ['-lz'],
+          'dll_prefix': 'lib',
+          'conditions': [
+            ['OS=="mac" or OS=="ios"', {
+              'moz_debug_flags%': '-gdwarf-2 -gfull',
+              'dll_suffix': 'dylib',
+            }, {
+              'moz_debug_flags%': '-gdwarf-2',
+              'dll_suffix': 'so',
+            }],
+          ],
+        }],
+        ['"<(GENERATOR)"=="ninja"', {
+          'cc_is_clang%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py clang)',
+        }, {
+          'cc_is_clang%': '0',
+        }],
+        ['"<(GENERATOR)"=="ninja"', {
+          'cc_is_gcc%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py gcc)',
+        }, {
+          'cc_is_gcc%': '0',
+        }],
+        ['"<(GENERATOR)"=="ninja"', {
+          'cc_is_cc%': '<!("<(python)" <(DEPTH)/coreconf/check_cc.py cc)',
+        }, {
+          'cc_is_cc%': '0',
+        }],
+      ],
+    },
+    # Copy conditionally-set variables out one scope.
+    'python%': '<(python)',
+    'host_arch%': '<(host_arch)',
+    'target_arch%': '<(target_arch)',
+    'use_system_zlib%': '<(use_system_zlib)',
+    'zlib_libs%': ['<@(zlib_libs)'],
+    'moz_debug_flags%': '<(moz_debug_flags)',
+    'nspr_libs%': ['<@(nspr_libs)'],
+    'nspr_lib_dir%': '<(nspr_lib_dir)',
+    'nspr_include_dir%': '<(nspr_include_dir)',
+    'use_system_sqlite%': '<(use_system_sqlite)',
+    'sqlite_libs%': ['-lsqlite3'],
+    'dll_prefix': '<(dll_prefix)',
+    'dll_suffix': '<(dll_suffix)',
+    'freebl_name': '<(freebl_name)',
+    'cc_is_clang%': '<(cc_is_clang)',
+    'cc_is_gcc%': '<(cc_is_gcc)',
+    'cc_use_gnu_ld%': '<(cc_use_gnu_ld)',
+    # Some defaults
+    'disable_arm_hw_aes%': 0,
+    'disable_arm_hw_sha1%': 0,
+    'disable_arm_hw_sha2%': 0,
+    'disable_intel_hw_sha%': 0,
+    'disable_tests%': 0,
+    'disable_chachapoly%': 0,
+    'disable_deprecated_seed%': 0,
+    'disable_deprecated_rc2%': 0,
+    'disable_dbm%': 1,
+    'disable_libpkix%': 1,
+    'disable_werror%': 0,
+    'disable_altivec%': 0,
+    'disable_crypto_vsx%': 0,
+    'disable_arm32_neon%': 0,
+    'mozilla_client%': 0,
+    'comm_client%': 0,
+    'moz_fold_libs%': 0,
+    'moz_folded_library_name%': '',
+    'sanitizer_flags%': 0,
+    'static_libs%': 0,
+    'no_zdefs%': 0,
+    'fuzz%': 0,
+    'fuzz_tls%': 0,
+    'fuzz_oss%': 0,
+    'sign_libs%': 1,
+    'use_pprof%': 0,
+    'ct_verif%': 0,
+    'emit_llvm%': 0,
+    'nss_public_dist_dir%': '<(nss_dist_dir)/public',
+    'nss_private_dist_dir%': '<(nss_dist_dir)/private',
+    # This is only needed when building with --mozpkix-only and might not work
+    # on all machines.
+    'nss_include_dir%': '/usr/include/nss',
+    'only_dev_random%': 1,
+    'disable_fips%': 1,
+    'mozpkix_only%': 0,
+    'mozilla_central%': 0,
+    'coverage%': 0,
+    'softfp_cflags%': '',
+    'enable_draft_hpke%': 0,
+    'force_integrated_as%': 0,
+    'disable_ckbi%': 0,
+  },
+  'target_defaults': {
+    # Settings specific to targets should go here.
+    # This is mostly for linking to libraries.
+    'variables': {
+      'mapfile%': '',
+      'static_libs%': 0,
+      'debug_optimization_level%': '0',
+      'release_optimization_level%': '2',
+    },
+    'standalone_static_library': 0,
+    'include_dirs': [
+      '<(nspr_include_dir)',
+      '<(nss_dist_dir)/private/<(module)',
+    ],
+    'conditions': [
+      [ 'mozpkix_only==1 and OS=="linux"', {
+        'include_dirs': [
+          '<(nss_include_dir)',
+        ],
+      }],
+      [ 'disable_fips==1', {
+        'defines': [
+          'NSS_FIPS_DISABLED',
+          'NSS_NO_INIT_SUPPORT',
+        ],
+      }],
+      [ 'OS!="android" and OS!="mac" and OS!="ios" and OS!="win"', {
+        'libraries': [
+          '-lpthread',
+        ],
+      }],
+      [ 'OS=="linux"', {
+        'libraries': [
+          '-ldl',
+          '-lc',
+        ],
+      }],
+      [ 'OS=="android"', {
+        'libraries': [
+          '-llog',
+        ],
+      }],
+      [ 'fuzz==1', {
+        'variables': {
+          'debug_optimization_level%': '1',
+        },
+      }],
+      [ 'target_arch=="ia32" or target_arch=="x64"', {
+        'defines': [
+          'NSS_X86_OR_X64',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X86_OR_X64',
+            ],
+          },
+        },
+      }],
+      [ 'target_arch=="ia32"', {
+        'defines': [
+          'NSS_X86',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X86',
+            ],
+          },
+        },
+      }],
+      [ 'target_arch=="arm64" or target_arch=="aarch64" or target_arch=="sparc64" or target_arch=="ppc64" or target_arch=="ppc64le" or target_arch=="s390x" or target_arch=="mips64" or target_arch=="e2k" or target_arch=="riscv64" or target_arch=="loongarch64"', {
+        'defines': [
+          'NSS_USE_64',
+        ],
+      }],
+      [ 'target_arch=="x64"', {
+        'defines': [
+          'NSS_X64',
+          'NSS_USE_64',
+        ],
+        # For Windows.
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'PreprocessorDefinitions': [
+              'NSS_X64',
+              'NSS_USE_64',
+            ],
+          },
+        },
+      }],
+    ],
+    'target_conditions': [
+      # If we want to properly export a static library, and copy it to lib,
+      # we need to mark it as a 'standalone_static_library'. Otherwise,
+      # the relative paths in the thin archive will break linking.
+      [ '_type=="shared_library"', {
+        'product_dir': '<(nss_dist_obj_dir)/lib'
+      }, '_type=="executable"', {
+        'product_dir': '<(nss_dist_obj_dir)/bin'
+      }, 'static_libs==1 or _standalone_static_library==1', {
+        'product_dir': '<(nss_dist_obj_dir)/lib'
+      }],
+      # mapfile handling
+      [ 'mapfile!=""', {
+        # Work around a gyp bug. Fixed upstream but not in Ubuntu packages:
+        # https://chromium.googlesource.com/external/gyp/+/b85ad3e578da830377dbc1843aa4fbc5af17a192%5E%21/
+        'sources': [
+          '<(DEPTH)/coreconf/empty.c',
+        ],
+        'xcode_settings': {
+          'OTHER_LDFLAGS': [
+            '-exported_symbols_list',
+            '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+          ],
+        },
+        'conditions': [
+          [ 'cc_use_gnu_ld==1', {
+            'ldflags': [
+              '-Wl,--version-script,<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+          }],
+          [ 'cc_use_gnu_ld!=1 and OS=="win"', {
+            # On Windows, .def files are used directly as sources.
+            'sources': [
+              '>(mapfile)',
+            ],
+          }, {
+            # On other platforms, .def files need processing.
+            'sources': [
+              '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+            ],
+            'actions': [{
+              'action_name': 'generate_mapfile',
+              'inputs': [
+                '>(mapfile)',
+              ],
+              'outputs': [
+                '<(INTERMEDIATE_DIR)/out.>(mapfile)',
+              ],
+              'action': ['<@(process_map_file)'],
+            }],
+          }]
+        ],
+      }, 'static_libs==1 and _type=="shared_library"', {
+        # When linking a shared lib against a static one, XCode doesn't
+        # export the latter's symbols by default. -all_load fixes that.
+        'xcode_settings': {
+          'OTHER_LDFLAGS': [
+            '-all_load',
+          ],
+        },
+      }],
+      [ '_type=="shared_library" or _type=="executable"', {
+        'libraries': [
+          '<@(nspr_libs)',
+        ],
+        'library_dirs': [
+          '<(nspr_lib_dir)',
+        ],
+      }],
+      # Shared library specific settings.
+      [ '_type=="shared_library"', {
+        'conditions': [
+          [ 'cc_use_gnu_ld==1', {
+            'ldflags': [
+              '-Wl,--gc-sections',
+            ],
+            'conditions': [
+              ['no_zdefs==0', {
+                'ldflags': [
+                  '-Wl,-z,defs',
+                ],
+              }],
+            ],
+          }],
+        ],
+        'xcode_settings': {
+          'DYLIB_INSTALL_NAME_BASE': '@executable_path',
+          'DYLIB_COMPATIBILITY_VERSION': '1',
+          'DYLIB_CURRENT_VERSION': '1',
+          'OTHER_LDFLAGS': [
+            '-headerpad_max_install_names',
+          ],
+        },
+        'msvs_settings': {
+          'VCLinkerTool': {
+            'SubSystem': '2',
+          },
+        },
+      }],
+      [ '_type=="static_library" and static_libs==1', {
+        'standalone_static_library': 1,
+      }],
+    ],
+    'default_configuration': 'Debug',
+    'configurations': {
+      # Common settings for Debug+Release should go here.
+      'Common': {
+        'abstract': 1,
+        'defines': [
+          'USE_UTIL_DIRECTLY',
+          'NO_NSPR_10_SUPPORT',
+          'SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES',
+        ],
+        'msvs_configuration_attributes': {
+          'OutputDirectory': '$(SolutionDir)$(ConfigurationName)',
+          'IntermediateDirectory': '$(OutDir)\\obj\\$(ProjectName)',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'AdditionalIncludeDirectories': ['<(nspr_include_dir)'],
+          },
+        },
+        'xcode_settings': {
+          'CLANG_CXX_LANGUAGE_STANDARD': 'c++0x',
+          'OTHER_CFLAGS': [
+            '-fPIC',
+            '-fno-common',
+            '-pipe',
+          ],
+        },
+        'conditions': [
+          [ 'OS=="linux" or OS=="android"', {
+            'defines': [
+              'LINUX2_1',
+              'LINUX',
+              'linux',
+              '_DEFAULT_SOURCE', # for <endian.h> functions, strdup, realpath, and getentropy
+              '_BSD_SOURCE', # for the above in glibc <= 2.19
+              '_POSIX_SOURCE', # for <signal.h>
+              'SDB_MEASURE_USE_TEMP_DIR', # use tmpdir for the access calls
+            ],
+          }],
+          [ 'OS=="dragonfly" or OS=="freebsd"', {
+            'defines': [
+              'FREEBSD',
+            ],
+          }],
+          [ 'OS=="netbsd"', {
+            'defines': [
+              'NETBSD',
+            ],
+          }],
+          [ 'OS=="openbsd"', {
+            'defines': [
+              'OPENBSD',
+            ],
+          }],
+          ['OS=="mac" or OS=="ios" or OS=="dragonfly" or OS=="freebsd" or OS=="netbsd" or OS=="openbsd"', {
+            'defines': [
+              'HAVE_BSD_FLOCK',
+            ],
+          }],
+          [ 'OS!="win"', {
+            'defines': [
+              'HAVE_STRERROR',
+              'XP_UNIX',
+              '_REENTRANT',
+            ],
+          }],
+          [ 'OS!="mac" and OS!="ios" and OS!="solaris" and OS!="win"', {
+            'ldflags': [
+              '-z', 'noexecstack',
+            ],
+          }],
+          [ 'OS!="mac" and OS!="ios" and OS!="win"', {
+            'cflags': [
+              '-fPIC',
+              '-pipe',
+              '-ffunction-sections',
+              '-fdata-sections',
+            ],
+            'cflags_c': [
+              '-std=c99',
+            ],
+            'cflags_cc': [
+              '-std=c++11',
+            ],
+            'conditions': [
+              [ 'target_arch=="ia32"', {
+                'cflags': ['-m32'],
+                'ldflags': ['-m32'],
+              }],
+              [ 'target_arch=="x64"', {
+                'cflags': ['-m64'],
+                'ldflags': ['-m64'],
+              }],
+            ],
+          }],
+          [ 'use_pprof==1 and OS!="android" and OS!="win"', {
+            'conditions': [
+              [ 'OS=="mac" or OS=="ios"', {
+                'xcode_settings': {
+                  'OTHER_LDFLAGS': [ '-lprofiler' ],
+                },
+              }, {
+                'ldflags': [ '-lprofiler' ],
+              }],
+              [ 'OS!="linux"', {
+                'library_dirs': [
+                  '/usr/local/lib/',
+                ],
+              }],
+            ],
+          }],
+          [ 'disable_werror==0 and OS!="android" and OS!="win"', {
+            'cflags': [
+              '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
+            ],
+            'xcode_settings': {
+              'OTHER_CFLAGS': [
+                '<!@("<(python)" <(DEPTH)/coreconf/werror.py)',
+              ],
+            },
+          }],
+          [ 'fuzz_tls==1', {
+            'cflags': [
+              '-Wno-unused-function',
+              '-Wno-unused-variable',
+            ],
+            'xcode_settings': {
+              'OTHER_CFLAGS': [
+                '-Wno-unused-function',
+                '-Wno-unused-variable',
+              ],
+            },
+          }],
+          [ 'sanitizer_flags!=0', {
+            'cflags': ['<@(sanitizer_flags)'],
+            'ldflags': ['<@(sanitizer_flags)'],
+            'xcode_settings': {
+              'OTHER_CFLAGS': ['<@(sanitizer_flags)'],
+              # We want to pass -fsanitize=... to our final link call,
+              # but not to libtool. OTHER_LDFLAGS is passed to both.
+              # To trick GYP into doing what we want, we'll piggyback on
+              # LIBRARY_SEARCH_PATHS, producing "-L/usr/lib -fsanitize=...".
+              # The -L/usr/lib is redundant but innocuous: it's a default path.
+              'LIBRARY_SEARCH_PATHS': ['/usr/lib <(sanitizer_flags)'],
+            },
+          }],
+          [ 'emit_llvm==1', {
+            'cflags': ['-flto'],
+            'ldflags': ['-flto', '-fuse-ld=gold', '-Wl,-plugin-opt=save-temps'],
+          }],
+          [ 'OS=="android" and mozilla_client==0', {
+            'defines': [
+              'NO_SYSINFO',
+              'NO_FORK_CHECK',
+              'ANDROID',
+            ],
+          }],
+          [ 'OS=="mac" or OS=="ios"', {
+            'defines': [
+              'DARWIN',
+            ],
+            'conditions': [
+              [ 'target_arch=="ia32"', {
+                'xcode_settings': {
+                  'ARCHS': ['i386'],
+                },
+              }],
+              [ 'target_arch=="x64"', {
+                'xcode_settings': {
+                  'ARCHS': ['x86_64'],
+                },
+              }],
+              [ 'target_arch=="arm64"', {
+                'xcode_settings': {
+                  'ARCHS': ['arm64'],
+                },
+              }],
+            ],
+          }],
+          [ 'OS=="ios"', {
+            'xcode_settings': {
+              'IPHONEOS_DEPLOYMENT_TARGET': '<(iphone_deployment_target)',
+            },
+          }],
+          [ 'OS=="win"', {
+            'defines': [
+              '_WINDOWS',
+              'WIN95',
+              '_CRT_SECURE_NO_WARNINGS',
+              '_CRT_NONSTDC_NO_WARNINGS',
+            ],
+            'cflags': [
+              '-W3',
+              '-w44267', # Disable C4267: conversion from 'size_t' to 'type', possible loss of data
+              '-w44244', # Disable C4244: conversion from 'type1' to 'type2', possible loss of data
+              '-w44018', # Disable C4018: 'expression' : signed/unsigned mismatch
+              '-w44312', # Disable C4312: 'type cast': conversion from 'type1' to 'type2' of greater size
+            ],
+            'conditions': [
+              [ 'disable_werror==0', {
+                'cflags': ['-WX']
+              }],
+              [ 'target_arch=="ia32"', {
+                'msvs_configuration_platform': 'Win32',
+                'msvs_settings': {
+                  'VCLinkerTool': {
+                    'MinimumRequiredVersion': '5.01',  # XP.
+                    'TargetMachine': '1',
+                    'ImageHasSafeExceptionHandlers': 'false',
+                  },
+                  'VCCLCompilerTool': {
+                    'PreprocessorDefinitions': [
+                      'WIN32',
+                    ],
+                    'AdditionalOptions': [ '/EHsc' ],
+                  },
+                },
+              }],
+              [ 'target_arch=="x64"', {
+                'msvs_configuration_platform': 'x64',
+                'msvs_settings': {
+                  'VCLinkerTool': {
+                    'TargetMachine': '17', # x86-64
+                  },
+                  'VCCLCompilerTool': {
+                    'PreprocessorDefinitions': [
+                      'WIN64',
+                      '_AMD64_',
+                    ],
+                    'AdditionalOptions': [ '/EHsc' ],
+                  },
+                },
+              }],
+            ],
+          }],
+          [ 'disable_dbm==1', {
+            'defines': [
+              'NSS_DISABLE_DBM',
+            ],
+          }],
+          [ 'disable_libpkix==1', {
+            'defines': [
+              'NSS_DISABLE_LIBPKIX',
+            ],
+          }],
+          [ 'disable_deprecated_seed==1', {
+            'defines': [
+              'NSS_DISABLE_DEPRECATED_SEED',
+            ],
+          }],
+          [ 'disable_deprecated_rc2==1', {
+            'defines': [
+              'NSS_DISABLE_DEPRECATED_RC2',
+            ],
+          }],
+        ],
+      },
+      # Common settings for debug should go here.
+      'Debug': {
+        'inherit_from': ['Common'],
+        'conditions': [
+          [ 'OS!="mac" and OS!="ios" and OS!="win"', {
+            'cflags': [
+              '-g',
+              '<(moz_debug_flags)',
+            ],
+          }]
+        ],
+        #TODO: DEBUG_$USER
+        'defines': ['DEBUG'],
+        'cflags': [ '-O<(debug_optimization_level)' ],
+        'xcode_settings': {
+          'COPY_PHASE_STRIP': 'NO',
+          'GCC_OPTIMIZATION_LEVEL': '<(debug_optimization_level)',
+          'GCC_GENERATE_DEBUGGING_SYMBOLS': 'YES',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '<(debug_optimization_level)',
+            'BasicRuntimeChecks': '3',
+            'RuntimeLibrary': '2', # /MD
+            'DebugInformationFormat': '3',
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+            'GenerateDebugInformation' : 'true',
+          },
+          'VCResourceCompilerTool': {
+            'PreprocessorDefinitions': ['DEBUG'],
+          },
+        },
+      },
+      # Common settings for release should go here.
+      'Release': {
+        'inherit_from': ['Common'],
+        'defines': ['NDEBUG'],
+        'cflags': [ '-O<(release_optimization_level)' ],
+        'xcode_settings': {
+          'DEAD_CODE_STRIPPING': 'YES',  # -Wl,-dead_strip
+          'GCC_OPTIMIZATION_LEVEL': '<(release_optimization_level)',
+        },
+        'msvs_settings': {
+          'VCCLCompilerTool': {
+            'Optimization': '<(release_optimization_level)',
+            'RuntimeLibrary': '2', # /MD
+          },
+          'VCLinkerTool': {
+            'LinkIncremental': '1',
+          },
+        },
+      },
+      'conditions': [
+        [ 'OS=="win"', {
+          # The gyp ninja backend requires these.
+          # TODO: either we should support building both 32/64-bit as
+          # configurations from the same gyp build, or we should fix
+          # upstream gyp to not require these.
+          'Debug_x64': {
+            'inherit_from': ['Debug'],
+          },
+          'Release_x64': {
+            'inherit_from': ['Release'],
+          },
+        }],
+      ],
+    },
+  },
+  'conditions': [
+    [ 'cc_use_gnu_ld==1 or OS=="solaris"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/usr/bin/env grep -v ";-" >(mapfile) | sed -e "s,;+,," -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,;," > >@(_outputs)'],
+      },
+    }],
+    [ 'OS=="mac" or OS=="ios"', {
+      'variables': {
+        'process_map_file': ['/bin/sh', '-c', '/usr/bin/grep -v ";+" >(mapfile) | grep -v ";-" | sed -e "s; DATA ;;" -e "s,;;,," -e "s,;.*,," -e "s,^,_," > >@(_outputs)'],
+      },
+    }],
+  ],
+}
diff --git a/security/nss/coreconf/config.mk b/security/nss/coreconf/config.mk
new file mode 100644
index 0000000000..741bbee2ef
--- /dev/null
+++ b/security/nss/coreconf/config.mk
@@ -0,0 +1,261 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Configuration information for building in the "Core Components" source module
+
+#######################################################################
+# [1.0] Master "Core Components" source and release <architecture>    #
+#       tags                                                          #
+#######################################################################
+ifndef MK_ARCH
+include $(CORE_DEPTH)/coreconf/arch.mk
+endif
+
+#######################################################################
+# [2.0] Master "Core Components" default command macros               #
+#       (NOTE: may be overridden in $(OS_TARGET)$(OS_RELEASE).mk)     #
+#######################################################################
+ifndef MK_COMMAND
+include $(CORE_DEPTH)/coreconf/command.mk
+endif
+
+#######################################################################
+# [3.0] Master "Core Components" <architecture>-specific macros       #
+#       (dependent upon <architecture> tags)                          #
+#                                                                     #
+#       We are moving towards just having a $(OS_TARGET).mk file      #
+#       as opposed to multiple $(OS_TARGET)$(OS_RELEASE).mk files,    #
+#       one for each OS release.                                      #
+#######################################################################
+
+TARGET_OSES = FreeBSD BSD_OS NetBSD OpenUNIX OS2 QNX Darwin OpenBSD \
+              AIX RISCOS WINNT WIN95 Linux Android
+
+ifeq (,$(filter-out $(TARGET_OSES),$(OS_TARGET)))
+include $(CORE_DEPTH)/coreconf/$(OS_TARGET).mk
+else
+ifeq ($(OS_TARGET),SunOS)
+include $(CORE_DEPTH)/coreconf/SunOS5.mk
+else
+include $(CORE_DEPTH)/coreconf/$(OS_TARGET)$(OS_RELEASE).mk
+endif
+endif
+
+#######################################################################
+# [4.0] Master "Core Components" source and release <platform> tags   #
+#       (dependent upon <architecture> tags)                          #
+#######################################################################
+PLATFORM = $(OBJDIR_NAME)
+
+#######################################################################
+# [5.0] Master "Core Components" release <tree> tags                  #
+#       (dependent upon <architecture> tags)                          #
+#######################################################################
+ifndef MK_TREE
+include $(CORE_DEPTH)/coreconf/tree.mk
+endif
+
+#######################################################################
+# [6.0] Master "Core Components" source and release <component> tags  #
+#       NOTE:  A component is also called a module or a subsystem.    #
+#       (dependent upon $(MODULE) being defined on the                #
+#        command line, as an environment variable, or in individual   #
+#        makefiles, or more appropriately, manifest.mn)               #
+#######################################################################
+ifndef MK_MODULE
+include $(CORE_DEPTH)/coreconf/module.mk
+endif
+
+#######################################################################
+# [7.0] Master "Core Components" release <version> tags               #
+#       (dependent upon $(MODULE) being defined on the                #
+#        command line, as an environment variable, or in individual   #
+#        makefiles, or more appropriately, manifest.mn)               #
+#######################################################################
+ifndef MK_VERSION
+include $(CORE_DEPTH)/coreconf/version.mk
+endif
+
+#######################################################################
+# [8.0] Master "Core Components" macros to figure out                 #
+#       binary code location                                          #
+#       (dependent upon <platform> tags)                              #
+#######################################################################
+ifndef MK_LOCATION
+include $(CORE_DEPTH)/coreconf/location.mk
+endif
+
+#######################################################################
+# [9.0] Master "Core Components" <component>-specific source path     #
+#       (dependent upon <user_source_tree>, <source_component>,       #
+#        <version>, and <platform> tags)                              #
+#######################################################################
+ifndef MK_SOURCE
+include $(CORE_DEPTH)/coreconf/source.mk
+endif
+
+#######################################################################
+# [10.0] Master "Core Components" include switch for support header   #
+#        files                                                        #
+#        (dependent upon <tree>, <component>, <version>,              #
+#         and <platform> tags)                                        #
+#######################################################################
+ifndef MK_HEADERS
+include $(CORE_DEPTH)/coreconf/headers.mk
+endif
+
+#######################################################################
+# [11.0] Master "Core Components" for computing program prefixes      #
+#######################################################################
+ifndef MK_PREFIX
+include $(CORE_DEPTH)/coreconf/prefix.mk
+endif
+
+#######################################################################
+# [12.0] Master "Core Components" for computing program suffixes      #
+#        (dependent upon <architecture> tags)                         #
+#######################################################################
+ifndef MK_SUFFIX
+include $(CORE_DEPTH)/coreconf/suffix.mk
+endif
+
+#######################################################################
+# [14.0] Master "Core Components" rule set                            #
+#######################################################################
+ifndef MK_RULESET
+include $(CORE_DEPTH)/coreconf/ruleset.mk
+endif
+
+#######################################################################
+# Master "Core Components" macros for Hardware features               #
+#######################################################################
+
+ifndef NSS_DISABLE_SSE3
+    NSS_DISABLE_SSE3 = 0
+    ifndef CC_IS_CLANG
+        ifeq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+            NSS_DISABLE_SSE3 = 1
+        endif
+    endif
+    ifeq (1,$(NSS_DISABLE_SSE3))
+        export NSS_DISABLE_SSE3
+    endif
+endif #ndef NSS_DISABLE_SSE3
+
+ifndef NSS_DISABLE_AVX2
+    ifneq ($(CPU_ARCH),x86_64)
+        # Disable AVX2 entirely on non-Intel platforms
+        NSS_DISABLE_AVX2 = 1
+        $(warning CPU_ARCH is not x86_64, disabling -mavx2)
+    else
+        # Clang reports its version as an older gcc, but it's OK
+        ifndef CC_IS_CLANG
+            ifneq (,$(filter 0 1 2 3 4,$(word 1,$(GCC_VERSION))))
+                NSS_DISABLE_AVX2 = 1
+            endif
+        endif
+        ifeq (1,$(NSS_DISABLE_AVX2))
+            $(warning Unable to find gcc 4.8 or greater, disabling -mavx2)
+            export NSS_DISABLE_AVX2
+        endif
+    endif
+endif #ndef NSS_DISABLE_AVX2
+
+#######################################################################
+# [16.0] Global environ ment defines
+#######################################################################
+
+ifdef NSS_ALLOW_UNSUPPORTED_CRITICAL
+DEFINES += -DNSS_ALLOW_UNSUPPORTED_CRITICAL
+endif
+
+ifdef BUILD_LIBPKIX_TESTS
+DEFINES += -DBUILD_LIBPKIX_TESTS
+endif
+
+ifdef NSS_DISABLE_LIBPKIX
+DEFINES += -DNSS_DISABLE_LIBPKIX
+endif
+
+ifdef NSS_DISABLE_DBM
+DEFINES += -DNSS_DISABLE_DBM
+endif
+
+ifdef NSS_DISABLE_AVX2
+DEFINES += -DNSS_DISABLE_AVX2
+endif
+
+ifdef NSS_DISABLE_SSE3
+DEFINES += -DNSS_DISABLE_SSE3
+endif
+
+ifdef NSS_DISABLE_CHACHAPOLY
+DEFINES += -DNSS_DISABLE_CHACHAPOLY
+endif
+
+ifdef NSS_DISABLE_DEPRECATED_SEED
+DEFINES += -DNSS_DISABLE_DEPRECATED_SEED
+endif
+
+ifdef NSS_DISABLE_DEPRECATED_RC2
+DEFINES += -DNSS_DISABLE_DEPRECATED_RC2
+endif
+
+ifdef NSS_PKIX_NO_LDAP
+DEFINES += -DNSS_PKIX_NO_LDAP
+endif
+
+# FIPS support requires startup tests to be executed at load time of shared modules.
+# For performance reasons, these tests are disabled by default.
+# When compiling binaries that must support FIPS mode,
+# you should define NSS_FORCE_FIPS
+#
+# NSS_NO_INIT_SUPPORT is always defined on platforms that don't support
+# executing the startup tests at library load time.
+ifndef NSS_FORCE_FIPS
+DEFINES += -DNSS_NO_INIT_SUPPORT
+endif
+
+ifdef NSS_SEED_ONLY_DEV_URANDOM
+DEFINES += -DSEED_ONLY_DEV_URANDOM
+endif
+
+ifdef NSS_PKCS1_AllowMissingParameters
+DEFINES += -DNSS_PKCS1_AllowMissingParameters
+endif
+
+# Avoid building object leak test code for optimized library
+ifndef BUILD_OPT
+ifdef PKIX_OBJECT_LEAK_TEST
+DEFINES += -DPKIX_OBJECT_LEAK_TEST
+endif
+endif
+
+# Avoid building with Neon acceleration on Arm32
+ifdef NSS_DISABLE_ARM32_NEON
+DEFINES += -DNSS_DISABLE_ARM32_NEON
+endif
+
+# Avoid building with PowerPC's Altivec acceleration
+ifeq ($(NSS_DISABLE_ALTIVEC),1)
+DEFINES += -DNSS_DISABLE_ALTIVEC
+endif
+
+# Avoid building with PowerPC's Crypto and VSX instructions
+ifeq ($(NSS_DISABLE_CRYPTO_VSX),1)
+DEFINES += -DNSS_DISABLE_CRYPTO_VSX
+endif
+
+# This allows all library and tools code to use the util function
+# implementations directly from libnssutil3, rather than the wrappers
+# in libnss3 which are present for binary compatibility only
+DEFINES += -DUSE_UTIL_DIRECTLY
+USE_UTIL_DIRECTLY = 1
+
+# Build with NO_NSPR_10_SUPPORT to avoid using obsolete NSPR features
+DEFINES += -DNO_NSPR_10_SUPPORT
+
+# Hide old, deprecated, TLS cipher suite names when building NSS
+DEFINES += -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES
diff --git a/security/nss/coreconf/coreconf.dep b/security/nss/coreconf/coreconf.dep
new file mode 100644
index 0000000000..590d1bfaee
--- /dev/null
+++ b/security/nss/coreconf/coreconf.dep
@@ -0,0 +1,13 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * A dummy header file that is a dependency for all the object files.
+ * Used to force a full recompilation of NSS in Mozilla's Tinderbox
+ * depend builds.  See comments in rules.mk.
+ */
+
+#error "Do not include this header file."
+
diff --git a/security/nss/coreconf/coreconf.pl b/security/nss/coreconf/coreconf.pl
new file mode 100644
index 0000000000..7cf3e57d04
--- /dev/null
+++ b/security/nss/coreconf/coreconf.pl
@@ -0,0 +1,128 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+sub recursive_copy {
+    local($fromdir);
+    local($todir);
+    local(@dirlist);
+    $fromdir = shift;
+    $todir = shift;
+  
+    print STDERR "recursive copy called with $fromdir, $todir\n";
+
+#remove any trailing slashes.
+    $fromdir =~ s/\/$//;
+    $todir =~ s/\/$//;
+    
+    opendir(DIR, $fromdir);
+    @dirlist = readdir DIR;
+    close DIR;
+
+
+    foreach $file (@dirlist) {
+	if  (! (($file eq "." ) || ($file eq "..") )) {
+	    
+	    if (-d "$fromdir/$file") {
+		print STDERR "handling directory $todir/$file\n";
+		&rec_mkdir("$todir/$file");
+		&recursive_copy("$fromdir/$file","$todir/$file");
+	    }
+	    else {
+		print STDERR "handling file $fromdir/$file\n";
+		&my_copy("$fromdir/$file","$todir/$file");
+	    }
+	}
+    }
+}
+
+sub parse_argv {
+
+#    print STDERR "Parsing Variables\n";
+
+    foreach $q ( @ARGV ) {
+	if (! ($q =~ /=/)) {
+	    $var{$lastassigned} .= " $q";
+	}
+	else {
+	   $q =~ /^([^=]*)=(.*)/;
+	   $left = $1;
+	   $right = $2;
+	
+	   $right =~ s/ *$//;
+	   $var{$left} = $right;
+
+	   $lastassigned = $left;
+	
+	   }
+	print STDERR "Assigned $lastassigned = $var{$lastassigned}\n";
+    }
+}
+
+
+# usage: &my_copy("dir/fromfile","dir2/tofile");
+# do a 'copy' - files only, 'to' MUST be a filename, not a directory.
+
+# fix this to be able to use copy on win nt.
+
+sub my_copy {
+    local($from);
+    local($to);
+    local($cpcmd);
+
+    $from = shift;
+    $to = shift;
+
+    if ( ! defined $var{OS_ARCH}) {
+	die "OS_ARCH not defined!";
+    }
+    else {
+	if ($var{OS_ARCH} eq 'WINNT') {
+	    $cpcmd = 'cp';
+	    	}
+	else {
+	    $cpcmd = 'cp';
+	    }
+	print STDERR "COPYING: $cpcmd $from $to\n";
+	system("$cpcmd $from $to");
+    }
+}
+
+
+sub old_my_copy {
+    local($from);
+    local($to);
+
+    $from = shift;
+    $to = shift;
+    open(FIN, "<$from") || die("Can't read from file $from\n");
+    if ( ! open(FOUT,">$to")) {
+	close FIN;
+	die "Can't write to file $to\n";
+    }
+    while (read(FIN, $buf, 100000)) {
+	print FOUT $buf;
+    }
+    close (FIN);
+    close (FOUT);
+}
+
+sub rec_mkdir {
+    local($arg);
+    local($t);
+    local($q);
+
+    $arg = shift;
+    $t = "";
+    foreach $q (split(/\//,$arg)) {
+	$t .= $q;
+	if (! ($t =~ /\.\.$/)) {
+	    if ($t =~ /./) {
+		mkdir($t,0775);
+	    }
+	}
+	$t.= '/';
+    }
+}
+
+1;
diff --git a/security/nss/coreconf/detect_host_arch.py b/security/nss/coreconf/detect_host_arch.py
new file mode 100644
index 0000000000..69fd960f65
--- /dev/null
+++ b/security/nss/coreconf/detect_host_arch.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this file,
+# You can obtain one at http://mozilla.org/MPL/2.0/.
+
+from __future__ import print_function
+
+import fnmatch
+import platform
+
+def main():
+    host_arch = platform.machine().lower()
+    if host_arch in ('amd64', 'x86_64'):
+        host_arch = 'x64'
+    elif fnmatch.fnmatch(host_arch, 'i?86') or host_arch == 'i86pc':
+        host_arch = 'ia32'
+    elif host_arch == 'arm64':
+        pass
+    elif host_arch.startswith('arm'):
+        host_arch = 'arm'
+    elif host_arch.startswith('mips64'):
+        host_arch = 'mips64'
+    elif host_arch.startswith('mips'):
+        host_arch = 'mips'
+    print(host_arch)
+
+if __name__ == '__main__':
+    main()
diff --git a/security/nss/coreconf/empty.c b/security/nss/coreconf/empty.c
new file mode 100644
index 0000000000..a8cf976f75
--- /dev/null
+++ b/security/nss/coreconf/empty.c
@@ -0,0 +1 @@
+/* This file is intentionally empty */
diff --git a/security/nss/coreconf/fuzz.sh b/security/nss/coreconf/fuzz.sh
new file mode 100644
index 0000000000..a9e8e2dba6
--- /dev/null
+++ b/security/nss/coreconf/fuzz.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+# This file is used by build.sh to setup fuzzing.
+
+set +e
+
+# Default to clang if CC is not set.
+if [ -z "$CC" ]; then
+    if ! command -v clang &> /dev/null 2>&1; then
+        echo "Fuzzing requires clang!"
+        exit 1
+    fi
+    export CC=clang
+    export CCC=clang++
+    export CXX=clang++
+fi
+
+gyp_params+=(-Dstatic_libs=1 -Dfuzz=1 -Dsign_libs=0)
+
+# Add debug symbols even for opt builds.
+nspr_params+=(--enable-debug-symbols)
+
+if [ "$fuzz_oss" = 1 ]; then
+  gyp_params+=(-Dno_zdefs=1 -Dfuzz_oss=1)
+else
+  enable_sanitizer asan
+  enable_sanitizer fuzzer
+  # Ubsan only builds on x64 for the moment.
+  if [ "$target_arch" = "x64" ]; then
+    enable_ubsan
+  fi
+fi
+
+if [ "$fuzz_tls" = 1 ]; then
+  gyp_params+=(-Dfuzz_tls=1)
+fi
diff --git a/security/nss/coreconf/headers.mk b/security/nss/coreconf/headers.mk
new file mode 100644
index 0000000000..d34c5af7d0
--- /dev/null
+++ b/security/nss/coreconf/headers.mk
@@ -0,0 +1,24 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" include switch for support header files    #
+#######################################################################
+
+#
+#  Always append source-side machine-dependent (md) and cross-platform
+#  (xp) include paths
+#
+
+INCLUDES += -I$(SOURCE_MDHEADERS_DIR) -I$(SOURCE_XPHEADERS_DIR)
+
+#
+#  Only append source-side private cross-platform include paths for
+#  sectools
+#
+
+INCLUDES += -I$(SOURCE_XPPRIVATE_DIR)
+
+MK_HEADERS = included
diff --git a/security/nss/coreconf/location.mk b/security/nss/coreconf/location.mk
new file mode 100644
index 0000000000..9c43394d8c
--- /dev/null
+++ b/security/nss/coreconf/location.mk
@@ -0,0 +1,75 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" macros to figure out binary code location  #
+#######################################################################
+
+#
+# Figure out where the binary code lives.
+#
+
+ifdef BUILD_TREE
+ifdef LIBRARY_NAME
+BUILD         = $(BUILD_TREE)/nss/$(LIBRARY_NAME)
+OBJDIR        = $(BUILD_TREE)/nss/$(LIBRARY_NAME)
+else
+BUILD         = $(BUILD_TREE)/nss
+OBJDIR        = $(BUILD_TREE)/nss
+endif
+else
+BUILD         = $(PLATFORM)
+OBJDIR        = $(PLATFORM)
+endif
+
+DIST          = $(SOURCE_PREFIX)/$(PLATFORM)
+
+ifdef BUILD_DEBUG_GC
+    DEFINES += -DDEBUG_GC
+endif
+
+GARBAGE += core $(wildcard core.[0-9]*)
+
+ifdef NSPR_INCLUDE_DIR
+    INCLUDES += -I$(NSPR_INCLUDE_DIR)
+endif
+
+ifndef NSPR_LIB_DIR
+    NSPR_LIB_DIR = $(DIST)/lib
+endif
+
+ifdef NSS_INCLUDE_DIR
+    INCLUDES += -I$(NSS_INCLUDE_DIR)
+endif
+
+ifndef NSS_LIB_DIR
+    NSS_LIB_DIR = $(DIST)/lib
+endif
+
+ifdef NSSUTIL_INCLUDE_DIR
+    INCLUDES += -I$(NSSUTIL_INCLUDE_DIR)
+endif
+
+ifndef NSSUTIL_LIB_DIR
+    NSSUTIL_LIB_DIR = $(DIST)/lib
+endif
+
+ifdef SOFTOKEN_INCLUDE_DIR
+    INCLUDES += -I$(SOFTOKEN_INCLUDE_DIR)
+endif
+
+ifndef SOFTOKEN_LIB_DIR
+    SOFTOKEN_LIB_DIR = $(DIST)/lib
+endif
+
+ifndef SQLITE_LIB_DIR
+    SQLITE_LIB_DIR = $(DIST)/lib
+endif
+
+ifndef SQLITE_LIB_NAME
+    SQLITE_LIB_NAME = sqlite3
+endif
+
+MK_LOCATION = included
diff --git a/security/nss/coreconf/module.mk b/security/nss/coreconf/module.mk
new file mode 100644
index 0000000000..f9ddf6a170
--- /dev/null
+++ b/security/nss/coreconf/module.mk
@@ -0,0 +1,33 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# The master "Core Components" source and release component directory #
+# names are ALWAYS identical and are the value of $(MODULE).          #
+# NOTE:  A component is also called a module or a subsystem.          #
+#######################################################################
+
+#
+#  All "Core Components" <component>-specific source-side tags must
+#  always be identified for compiling/linking purposes
+#
+
+ifndef NETLIB_SOURCE_COMPONENT
+    NETLIB_SOURCE_COMPONENT = netlib
+endif
+
+ifndef NSPR_SOURCE_COMPONENT
+    NSPR_SOURCE_COMPONENT = nspr20
+endif
+
+ifndef SECTOOLS_SOURCE_COMPONENT
+    SECTOOLS_SOURCE_COMPONENT = sectools
+endif
+
+ifndef SECURITY_SOURCE_COMPONENT
+    SECURITY_SOURCE_COMPONENT = security
+endif
+
+MK_MODULE = included
diff --git a/security/nss/coreconf/msvc.sh b/security/nss/coreconf/msvc.sh
new file mode 100644
index 0000000000..a592279c90
--- /dev/null
+++ b/security/nss/coreconf/msvc.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+# This configures the environment for running MSVC.  It uses vswhere, the
+# registry, and a little knowledge of how MSVC is laid out.
+
+if ! hash vswhere 2>/dev/null; then
+    echo "Can't find vswhere on the path, aborting" 1>&2
+    exit 1
+fi
+
+if ! hash reg 2>/dev/null; then
+    echo "Can't find reg on the path, aborting" 1>&2
+    exit 1
+fi
+
+# Turn a unix-y path into a windows one.
+fixpath() {
+    if hash cygpath 2>/dev/null; then
+        cygpath --unix "$1"
+    else # haxx
+        echo "$1" | sed -e 's,\\,/,g;s,^\(.\):,/\L\1,;s,/$,,'
+    fi
+}
+
+# Query the registry.  This takes $1 and tags that on the end of several
+# different paths, looking for a value called $2 at that location.
+# e.g.,
+#   regquery Microsoft\Microsoft SDKs\Windows\v10.0 ProductVersion
+# looks for a REG_SZ value called ProductVersion at
+#   HKLM\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows\v10.0
+#   HKLU\SOFTWARE\Wow6432Node\Microsoft\Microsoft SDKs\Windows\v10.0
+#   etc...
+regquery() {
+    search=("HKLM\\SOFTWARE\\Wow6432Node" \
+            "HKCU\\SOFTWARE\\Wow6432Node" \
+            "HKLM\\SOFTWARE" \
+            "HKCU\\SOFTWARE")
+    for i in "${search[@]}"; do
+        r=$(reg query "${i}\\${1}" -v "$2" | sed -e 's/ *'"$2"' *REG_SZ *//;t;d')
+        if [ -n "$r" ]; then
+            echo "$r"
+            return 0
+        fi
+    done
+    return 1
+}
+
+VSCOMPONENT=Microsoft.VisualStudio.Component.VC.Tools.x86.x64
+vsinstall=$(vswhere -latest -requires "$VSCOMPONENT" -property installationPath)
+
+# Attempt to setup paths if vswhere returns something and VSPATH isn't set.
+# Otherwise, assume that the env is setup.
+if [[ -n "$vsinstall" && -z "$VSPATH" ]]; then
+
+    case "$target_arch" in
+        ia32) m=x86 ;;
+        x64) m="$target_arch" ;;
+        *)
+            echo "No support for target '$target_arch' with MSVC." 1>&2
+            exit 1
+    esac
+
+    export VSPATH=$(fixpath "$vsinstall")
+    export WINDOWSSDKDIR="${VSPATH}/SDK"
+    export VCINSTALLDIR="${VSPATH}/VC"
+
+    CRTREG="Microsoft\\Microsoft SDKs\\Windows\\v10.0"
+    UniversalCRTSdkDir=$(regquery "$CRTREG" InstallationFolder)
+    UniversalCRTSdkDir=$(fixpath "$UniversalCRTSdkDir")
+    UCRTVersion=$(regquery "$CRTREG" ProductVersion)
+    UCRTVersion=$(cd "${UniversalCRTSdkDir}/include"; ls -d "${UCRTVersion}"* | tail -1)
+
+    VCVER=$(cat "${VCINSTALLDIR}/Auxiliary/Build/Microsoft.VCToolsVersion.default.txt")
+    REDISTVER=$(cat "${VCINSTALLDIR}/Auxiliary/Build/Microsoft.VCRedistVersion.default.txt")
+    export WIN32_REDIST_DIR="${VCINSTALLDIR}/Redist/MSVC/${REDISTVER}/${m}/Microsoft.VC141.CRT"
+    export WIN_UCRT_REDIST_DIR="${UniversalCRTSdkDir}/Redist/ucrt/DLLs/${m}"
+
+    if [ "$m" == "x86" ]; then
+        PATH="${PATH}:${VCINSTALLDIR}/Tools/MSVC/${VCVER}/bin/Hostx64/x64"
+        PATH="${PATH}:${VCINSTALLDIR}/Tools/MSVC/${VCVER}/bin/Hostx64/x86"
+    fi
+    PATH="${PATH}:${VCINSTALLDIR}/Tools/MSVC/${VCVER}/bin/Host${m}/${m}"
+    PATH="${PATH}:${UniversalCRTSdkDir}/bin/${UCRTVersion}/${m}"
+    PATH="${PATH}:${WIN32_REDIST_DIR}"
+    export PATH
+
+    INCLUDE="${VCINSTALLDIR}/Tools/MSVC/${VCVER}/ATLMFC/include"
+    INCLUDE="${INCLUDE}:${VCINSTALLDIR}/Tools/MSVC/${VCVER}/include"
+    INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/ucrt"
+    INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/shared"
+    INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/um"
+    INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/winrt"
+    INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/cppwinrt"
+    export INCLUDE
+
+    LIB="${VCINSTALLDIR}/lib/${m}"
+    LIB="${VCINSTALLDIR}/Tools/MSVC/${VCVER}/lib/${m}"
+    LIB="${LIB}:${UniversalCRTSdkDir}/lib/${UCRTVersion}/ucrt/${m}"
+    LIB="${LIB}:${UniversalCRTSdkDir}/lib/${UCRTVersion}/um/${m}"
+    export LIB
+
+    export GYP_MSVS_OVERRIDE_PATH="${VSPATH}"
+    export GYP_MSVS_VERSION=$(vswhere -latest -requires "$VSCOMPONENT" -property catalog_productLineVersion)
+else
+    echo Assuming env setup is already done.
+    echo VSPATH=$VSPATH
+fi
diff --git a/security/nss/coreconf/nsinstall/Makefile b/security/nss/coreconf/nsinstall/Makefile
new file mode 100644
index 0000000000..5061789ffe
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/Makefile
@@ -0,0 +1,47 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+DEPTH		= ../..
+CORE_DEPTH	= ../..
+
+MODULE		= coreconf
+
+CSRCS		= nsinstall.c pathsub.c
+
+PROGRAM		= nsinstall
+
+# Indicate that this directory builds build tools.
+INTERNAL_TOOLS  = 1
+
+
+include $(DEPTH)/coreconf/config.mk
+
+ifeq (,$(filter-out OS2 WIN%,$(OS_TARGET)))
+PROGRAM		=
+TARGETS		=
+else
+TARGETS		= $(PROGRAM)
+INSTALL		= true
+endif
+
+ifdef NATIVE_CC
+CC=$(NATIVE_CC)
+endif
+
+ifdef NATIVE_FLAGS
+OS_CFLAGS=$(NATIVE_FLAGS)
+endif
+
+ifdef NATIVE_LDFLAGS
+LDFLAGS=$(NATIVE_LDFLAGS)
+endif
+
+include $(DEPTH)/coreconf/rules.mk
+
+# Redefine MAKE_OBJDIR for just this directory
+define MAKE_OBJDIR
+if test ! -d $(@D); then mkdir -p $(@D); fi
+endef
+
diff --git a/security/nss/coreconf/nsinstall/nsinstall.c b/security/nss/coreconf/nsinstall/nsinstall.c
new file mode 100644
index 0000000000..da53797591
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/nsinstall.c
@@ -0,0 +1,404 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+** Netscape portable install command.
+*/
+#include <stdio.h>  /* OSF/1 requires this before grp.h, so put it first */
+#include <assert.h>
+#include <fcntl.h>
+#include <string.h>
+#if defined(_WINDOWS)
+#include <windows.h>
+typedef unsigned int mode_t;
+#else
+#include <grp.h>
+#include <pwd.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <utime.h>
+#endif
+#include <sys/types.h>
+#include <sys/stat.h>
+#include "pathsub.h"
+
+#define HAVE_LCHOWN
+
+#if defined(AIX) || defined(BSDI) || defined(HPUX) || defined(LINUX) || defined(SUNOS4) || defined(SCO) || defined(UNIXWARE) || defined(NTO) || defined(DARWIN) || defined(__riscos__)
+#undef HAVE_LCHOWN
+#endif
+
+#define HAVE_FCHMOD
+
+#ifdef LINUX
+#include <getopt.h>
+#endif
+
+#if defined(SCO) || defined(UNIXWARE) || defined(SNI) || defined(NCR) || defined(NEC)
+#if !defined(S_ISLNK) && defined(S_IFLNK)
+#define S_ISLNK(a)	(((a) & S_IFMT) == S_IFLNK)
+#endif
+#endif
+
+#if defined(SNI)
+extern int fchmod(int fildes, mode_t mode);
+#endif
+
+
+#ifdef GETCWD_CANT_MALLOC
+/*
+ * this should probably go into a utility library in case other applications
+ * need it.
+ */
+static char *
+getcwd_do_malloc(char *path, int len) {
+
+    if (!path) {
+	path = malloc(PATH_MAX +1);
+	if (!path) return NULL;
+    }
+    return getcwd(path, PATH_MAX);
+}
+#define GETCWD	getcwd_do_malloc
+#else
+#define GETCWD	getcwd
+#endif
+
+
+static void
+usage(void)
+{
+    fprintf(stderr,
+	"usage: %s [-C cwd] [-L linkprefix] [-m mode] [-o owner] [-g group]\n"
+	"       %*s [-DdltR] file [file ...] directory\n",
+	program, (int)strlen(program), "");
+    exit(2);
+}
+
+/* this is more-or-less equivalent to mkdir -p */
+static int
+mkdirs(char *path, mode_t mode)
+{
+    char *      cp;
+    int         rv;
+    struct stat sb;
+
+    if (!path || !path[0])
+	fail("Null pointer or empty string passed to mkdirs()");
+    while (*path == '/' && path[1] == '/')
+	path++;
+    for (cp = strrchr(path, '/'); cp && cp != path && *(cp - 1) == '/'; cp--);
+    if (cp && cp != path) {
+	*cp = '\0';
+	if ((stat(path, &sb) < 0 || !S_ISDIR(sb.st_mode)) &&
+	    mkdirs(path, mode) < 0) {
+	    return -1;
+	}
+	*cp = '/';
+    }
+    rv = mkdir(path, mode);
+    if (rv) {
+	if (errno != EEXIST)
+	    fail("mkdirs cannot make %s", path);
+	fprintf(stderr, "directory creation race: %s\n", path);
+	if (!stat(path, &sb) && S_ISDIR(sb.st_mode))
+	    rv = 0;
+    }
+    return rv;
+}
+
+static uid_t
+touid(char *owner)
+{
+    struct passwd *pw;
+    uid_t uid;
+    char *cp;
+
+    if (!owner || !owner[0])
+	fail("Null pointer or empty string passed to touid()");
+    pw = getpwnam(owner);
+    if (pw)
+	return pw->pw_uid;
+    uid = strtol(owner, &cp, 0);
+    if (uid == 0 && cp == owner)
+	fail("cannot find uid for %s", owner);
+    return uid;
+}
+
+static gid_t
+togid(char *group)
+{
+    struct group *gr;
+    gid_t gid;
+    char *cp;
+
+    if (!group || !group[0])
+	fail("Null pointer or empty string passed to togid()");
+    gr = getgrnam(group);
+    if (gr)
+	return gr->gr_gid;
+    gid = strtol(group, &cp, 0);
+    if (gid == 0 && cp == group)
+	fail("cannot find gid for %s", group);
+    return gid;
+}
+
+void * const uninit = (void *)0xdeadbeef;
+
+int
+main(int argc, char **argv)
+{
+    char *	base		= uninit;
+    char *	bp		= uninit;
+    char *	cp		= uninit;
+    char *	cwd		= 0;
+    char *	group		= 0;
+    char *	linkname	= 0;
+    char *	linkprefix	= 0;
+    char *	name		= uninit;
+    char *	owner		= 0;
+    char *	todir		= uninit;
+    char *	toname		= uninit;
+
+    int 	bnlen		= -1;
+    int 	cc		= 0;
+    int 	dodir		= 0;
+    int 	dolink		= 0;
+    int 	dorelsymlink	= 0;
+    int 	dotimes		= 0;
+    int 	exists		= 0;
+    int 	fromfd		= -1;
+    int 	len		= -1;
+    int 	lplen		= 0;
+    int		onlydir		= 0;
+    int 	opt		= -1;
+    int 	tdlen		= -1;
+    int 	tofd		= -1;
+    int 	wc		= -1;
+
+    mode_t 	mode		= 0755;
+
+    uid_t 	uid		= -1;
+    gid_t 	gid		= -1;
+
+    struct stat sb;
+    struct stat tosb;
+    struct utimbuf utb;
+    char 	buf[BUFSIZ];
+
+    program = strrchr(argv[0], '/');
+    if (!program)
+	program = strrchr(argv[0], '\\');
+    program = program ? program+1 : argv[0];
+
+
+    while ((opt = getopt(argc, argv, "C:DdlL:Rm:o:g:t")) != EOF) {
+	switch (opt) {
+	  case 'C': cwd = optarg;	break;
+	  case 'D': onlydir = 1; 	break;
+	  case 'd': dodir = 1; 		break;
+	  case 'l': dolink = 1;		break;
+	  case 'L':
+	    linkprefix = optarg;
+	    lplen = strlen(linkprefix);
+	    dolink = 1;
+	    break;
+	  case 'R': dolink = dorelsymlink = 1; break;
+	  case 'm':
+	    mode = strtoul(optarg, &cp, 8);
+	    if (mode == 0 && cp == optarg)
+		usage();
+	    break;
+	  case 'o': owner = optarg; 	break;
+	  case 'g': group = optarg; 	break;
+	  case 't': dotimes = 1; 	break;
+	  default:  usage();
+	}
+    }
+
+    argc -= optind;
+    argv += optind;
+    if (argc < 2 - onlydir)
+	usage();
+
+    todir = argv[argc-1];
+    if ((stat(todir, &sb) < 0 || !S_ISDIR(sb.st_mode)) &&
+	mkdirs(todir, 0777) < 0) {
+	fail("cannot mkdir -p %s", todir);
+    }
+    if (onlydir)
+	return 0;
+
+    if (!cwd) {
+	cwd = GETCWD(0, PATH_MAX);
+	if (!cwd)
+	    fail("could not get CWD");
+    }
+
+    /* make sure we can get into todir. */
+    xchdir(todir);
+    todir = GETCWD(0, PATH_MAX);
+    if (!todir)
+	fail("could not get CWD in todir");
+    tdlen = strlen(todir);
+
+    /* back to original directory. */
+    xchdir(cwd);
+
+    uid = owner ? touid(owner) : -1;
+    gid = group ? togid(group) : -1;
+
+    while (--argc > 0) {
+	name   = *argv++;
+	len    = strlen(name);
+	base   = xbasename(name);
+	bnlen  = strlen(base);
+    size_t toname_len = tdlen + 1 + bnlen + 1;
+	toname = (char*)xmalloc(toname_len);
+	snprintf(toname, toname_len, "%s/%s", todir, base);
+retry:
+	exists = (lstat(toname, &tosb) == 0);
+
+	if (dodir) {
+	    /* -d means create a directory, always */
+	    if (exists && !S_ISDIR(tosb.st_mode)) {
+		int rv = unlink(toname);
+		if (rv)
+		    fail("cannot unlink %s", toname);
+		exists = 0;
+	    }
+	    if (!exists && mkdir(toname, mode) < 0) {
+	    	/* we probably have two nsinstall programs in a race here. */
+		if (errno == EEXIST && !stat(toname, &sb) &&
+		    S_ISDIR(sb.st_mode)) {
+		    fprintf(stderr, "directory creation race: %s\n", toname);
+		    goto retry;
+	    	}
+		fail("cannot make directory %s", toname);
+	    }
+	    if ((owner || group) && chown(toname, uid, gid) < 0)
+		fail("cannot change owner of %s", toname);
+	} else if (dolink) {
+	    if (*name == '/') {
+		/* source is absolute pathname, link to it directly */
+		linkname = 0;
+	    } else {
+		if (linkprefix) {
+		    /* -L implies -l and prefixes names with a $cwd arg. */
+		    len += lplen + 1;
+		    linkname = (char*)xmalloc(len + 1);
+		    snprintf(linkname, len+1, "%s/%s", linkprefix, name);
+		} else if (dorelsymlink) {
+		    /* Symlink the relative path from todir to source name. */
+		    linkname = (char*)xmalloc(PATH_MAX);
+
+		    if (*todir == '/') {
+			/* todir is absolute: skip over common prefix. */
+			lplen = relatepaths(todir, cwd, linkname);
+			strcpy(linkname + lplen, name);
+		    } else {
+			/* todir is named by a relative path: reverse it. */
+			reversepath(todir, name, len, linkname);
+			xchdir(cwd);
+		    }
+
+		    len = strlen(linkname);
+		}
+		name = linkname;
+	    }
+
+	    /* Check for a pre-existing symlink with identical content. */
+	    if (exists &&
+		(!S_ISLNK(tosb.st_mode) ||
+		 readlink(toname, buf, sizeof buf) != len ||
+		 strncmp(buf, name, len) != 0)) {
+		int rmrv;
+		rmrv = (S_ISDIR(tosb.st_mode) ? rmdir : unlink)(toname);
+		if (rmrv < 0) {
+		    fail("destination exists, cannot remove %s", toname);
+		}
+		exists = 0;
+	    }
+	    if (!exists && symlink(name, toname) < 0) {
+		if (errno == EEXIST) {
+		    fprintf(stderr, "symlink creation race: %s\n", toname);
+                    fail("symlink was attempted in working directory %s "
+                         "from %s to %s.\n", cwd, name, toname);
+		    goto retry;
+		}
+		diagnosePath(toname);
+		fail("cannot make symbolic link %s", toname);
+	    }
+#ifdef HAVE_LCHOWN
+	    if ((owner || group) && lchown(toname, uid, gid) < 0)
+		fail("cannot change owner of %s", toname);
+#endif
+
+	    if (linkname) {
+		free(linkname);
+		linkname = 0;
+	    }
+	} else {
+	    /* Copy from name to toname, which might be the same file. */
+	    fromfd = open(name, O_RDONLY);
+	    if (fromfd < 0 || fstat(fromfd, &sb) < 0)
+		fail("cannot access %s", name);
+	    if (exists &&
+	        (!S_ISREG(tosb.st_mode) || access(toname, W_OK) < 0)) {
+		int rmrv;
+		rmrv = (S_ISDIR(tosb.st_mode) ? rmdir : unlink)(toname);
+		if (rmrv < 0) {
+		    fail("destination exists, cannot remove %s", toname);
+		}
+	    }
+	    tofd = open(toname, O_CREAT | O_WRONLY, 0666);
+	    if (tofd < 0)
+		fail("cannot create %s", toname);
+
+	    bp = buf;
+	    while ((cc = read(fromfd, bp, sizeof buf)) > 0) {
+		while ((wc = write(tofd, bp, cc)) > 0) {
+		    if ((cc -= wc) == 0)
+			break;
+		    bp += wc;
+		}
+		if (wc < 0)
+		    fail("cannot write to %s", toname);
+	    }
+	    if (cc < 0)
+		fail("cannot read from %s", name);
+
+	    if (ftruncate(tofd, sb.st_size) < 0)
+		fail("cannot truncate %s", toname);
+	    if (dotimes) {
+		utb.actime = sb.st_atime;
+		utb.modtime = sb.st_mtime;
+		if (utime(toname, &utb) < 0)
+		    fail("cannot set times of %s", toname);
+	    }
+#ifdef HAVE_FCHMOD
+	    if (fchmod(tofd, mode) < 0)
+#else
+	    if (chmod(toname, mode) < 0)
+#endif
+		fail("cannot change mode of %s", toname);
+
+	    if ((owner || group) && fchown(tofd, uid, gid) < 0)
+		fail("cannot change owner of %s", toname);
+
+	    /* Must check for delayed (NFS) write errors on close. */
+	    if (close(tofd) < 0)
+		fail("close reports write error on %s", toname);
+	    close(fromfd);
+	}
+
+	free(toname);
+    }
+
+    free(cwd);
+    free(todir);
+    return 0;
+}
+
diff --git a/security/nss/coreconf/nsinstall/nsinstall.gyp b/security/nss/coreconf/nsinstall/nsinstall.gyp
new file mode 100644
index 0000000000..efff6bcbab
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/nsinstall.gyp
@@ -0,0 +1,21 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nsinstall',
+      'type': 'executable',
+      'sources': [
+        'nsinstall.c',
+        'pathsub.c'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'coreconf'
+  }
+}
\ No newline at end of file
diff --git a/security/nss/coreconf/nsinstall/pathsub.c b/security/nss/coreconf/nsinstall/pathsub.c
new file mode 100644
index 0000000000..95fa679120
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/pathsub.c
@@ -0,0 +1,272 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+** Pathname subroutines.
+*/
+#if defined(FREEBSD) || defined(BSDI) || defined(DARWIN)
+#include <sys/types.h>
+#endif /* FREEBSD */
+#include <dirent.h>
+#include <errno.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include "pathsub.h"
+#ifdef USE_REENTRANT_LIBC
+#include "libc_r.h"
+#endif /* USE_REENTRANT_LIBC */
+
+char *program;
+
+void
+fail(char *format, ...)
+{
+    int error;
+    va_list ap;
+
+#ifdef USE_REENTRANT_LIBC
+    R_STRERROR_INIT_R();
+#endif
+
+    error = errno;
+    fprintf(stderr, "%s: ", program);
+    va_start(ap, format);
+    vfprintf(stderr, format, ap);
+    va_end(ap);
+    if (error) {
+
+#ifdef USE_REENTRANT_LIBC
+    R_STRERROR_R(errno);
+	fprintf(stderr, ": %s", r_strerror_r);
+#else
+	fprintf(stderr, ": %s", strerror(errno));
+#endif
+    }
+
+    putc('\n', stderr);
+    abort();
+    exit(1);
+}
+
+char *
+getcomponent(char *path, char *name)
+{
+    if (*path == '\0')
+	return 0;
+    if (*path == '/') {
+	*name++ = '/';
+    } else {
+	do {
+	    *name++ = *path++;
+	} while (*path != '/' && *path != '\0');
+    }
+    *name = '\0';
+    while (*path == '/')
+	path++;
+    return path;
+}
+
+#ifdef UNIXWARE
+/* The static buffer in Unixware's readdir is too small. */
+struct dirent * readdir(DIR *d)
+{
+    static struct dirent *buf = NULL;
+#define MAX_PATH_LEN 1024
+
+    if (buf == NULL)
+	buf = (struct dirent *)xmalloc(sizeof(struct dirent) + MAX_PATH_LEN) ;
+    return readdir_r(d, buf);
+}
+#endif
+
+/* APPARENT BUG - ignores argument "dir", uses ".." instead. */
+char *
+ino2name(ino_t ino, char *dir)
+{
+    DIR *dp;
+    struct dirent *ep;
+    char *name;
+
+    dp = opendir("..");		/* XXX */
+    if (!dp)
+	fail("cannot read parent directory");
+    for (;;) {
+	if (!(ep = readdir(dp)))
+	    fail("cannot find current directory");
+	if (ep->d_ino == ino)
+	    break;
+    }
+    name = xstrdup(ep->d_name);
+    closedir(dp);
+    return name;
+}
+
+void *
+xmalloc(size_t size)
+{
+    void *p;
+
+    if (size <= 0)
+	fail("attempted to allocate %u bytes", size);
+    p = malloc(size);
+    if (!p)
+	fail("cannot allocate %u bytes", size);
+    return p;
+}
+
+char *
+xstrdup(char *s)
+{
+    if (!s || !s[0])
+	fail("Null pointer or empty string passed to xstrdup()");
+    return strcpy((char*)xmalloc(strlen(s) + 1), s);
+}
+
+char *
+xbasename(char *path)
+{
+    char *cp;
+
+    if (!path || !path[0])
+	fail("Null pointer or empty string passed to xbasename()");
+    while ((cp = strrchr(path, '/')) && cp[1] == '\0')
+	*cp = '\0';
+    if (!cp) return path;
+    return cp + 1;
+}
+
+void
+xchdir(char *dir)
+{
+    if (!dir || !dir[0])
+	fail("Null pointer or empty string passed to xchdir()");
+    if (chdir(dir) < 0)
+	fail("cannot change directory to %s", dir);
+}
+
+int
+relatepaths(char *from, char *to, char *outpath)
+{
+    char *cp, *cp2;
+    int len;
+    char buf[NAME_MAX];
+
+    if (!from || *from != '/')
+	fail("relatepaths: from path does not start with /");
+    if (!to || *to != '/')
+	fail("relatepaths: to   path does not start with /");
+
+    for (cp = to, cp2 = from; *cp == *cp2; cp++, cp2++)
+	if (*cp == '\0')
+	    break;
+    while (cp[-1] != '/')
+	cp--, cp2--;
+    if (cp - 1 == to) {
+	/* closest common ancestor is /, so use full pathname */
+	len = strlen(strcpy(outpath, to));
+	if (outpath[len] != '/') {
+	    outpath[len++] = '/';
+	    outpath[len] = '\0';
+	}
+    } else {
+	len = 0;
+	while ((cp2 = getcomponent(cp2, buf)) != 0) {
+	    strcpy(outpath + len, "../");
+	    len += 3;
+	}
+	while ((cp = getcomponent(cp, buf)) != 0) {
+	    snprintf(outpath + len, PATH_MAX - len, "%s/", buf);
+	    len += strlen(outpath + len);
+	}
+    }
+    return len;
+}
+
+void
+reversepath(char *inpath, char *name, int len, char *outpath)
+{
+    char *cp, *cp2;
+    char buf[NAME_MAX];
+    struct stat sb;
+
+    cp = strcpy(outpath + PATH_MAX - (len + 1), name);
+    cp2 = inpath;
+    while ((cp2 = getcomponent(cp2, buf)) != 0) {
+	if (strcmp(buf, ".") == 0)
+	    continue;
+	if (strcmp(buf, "..") == 0) {
+	    if (stat(".", &sb) < 0)
+		fail("cannot stat current directory");
+	    name = ino2name(sb.st_ino, "..");
+	    len = strlen(name);
+	    cp -= len + 1;
+	    strcpy(cp, name);
+	    cp[len] = '/';
+	    free(name);
+	    xchdir("..");
+	} else {
+	    cp -= 3;
+	    memcpy(cp, "../", 3);
+	    xchdir(buf);
+	}
+    }
+    strcpy(outpath, cp);
+}
+
+void
+diagnosePath(const char * path)
+{
+    char *	myPath;
+    char *      slash;
+    int		rv;
+    struct stat sb;
+    char 	buf[BUFSIZ];
+
+    if (!path || !path[0])
+	fail("Null pointer or empty string passed to mkdirs()");
+    myPath = strdup(path);
+    if (!myPath)
+	fail("strdup() failed!");
+    do {
+    	rv = lstat(myPath, &sb);
+	if (rv < 0) {
+	    perror(myPath);
+	} else if (S_ISLNK(sb.st_mode)) {
+	    rv = readlink(myPath, buf, sizeof(buf) - 1);
+	    if (rv < 0) {
+	    	perror("readlink");
+		buf[0] = 0;
+	    } else {
+	    	buf[rv] = 0;
+	    }
+	    fprintf(stderr, "%s is a link to %s\n", myPath, buf);
+	} else if (S_ISDIR(sb.st_mode)) {
+	    fprintf(stderr, "%s is a directory\n", myPath);
+	    rv = access(myPath, X_OK);
+	    if (rv < 0) {
+	    	fprintf(stderr, "%s: no search permission\n", myPath);
+	    }
+	} else {
+	    fprintf(stderr, "%s is a file !?!\n", myPath);
+	    rv = access(myPath, F_OK);
+	    if (rv < 0) {
+	    	fprintf(stderr, "%s does not exist\n", myPath);
+	    }
+	}
+
+	/* chop path off one level. */
+	slash = strrchr(myPath, '/');
+	if (!slash)
+	    slash = strrchr(myPath, '\\');
+	if (!slash)
+	    slash = myPath;
+	*slash = 0;
+    } while (myPath[0]);
+    free(myPath);
+}
diff --git a/security/nss/coreconf/nsinstall/pathsub.h b/security/nss/coreconf/nsinstall/pathsub.h
new file mode 100644
index 0000000000..aea523b168
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/pathsub.h
@@ -0,0 +1,48 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef pathsub_h___
+#define pathsub_h___
+/*
+** Pathname subroutines.
+**
+** Brendan Eich, 8/29/95
+*/
+#include <limits.h>
+#include <sys/types.h>
+
+#if SUNOS4
+#include "sunos4.h"
+#endif
+
+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+
+/*
+ * Just keep sane lengths
+ */
+#undef NAME_MAX
+#define NAME_MAX 256
+
+extern char *program;
+
+extern void fail(char *format, ...);
+extern char *getcomponent(char *path, char *name);
+extern char *ino2name(ino_t ino, char *dir);
+extern void *xmalloc(size_t size);
+extern char *xstrdup(char *s);
+extern char *xbasename(char *path);
+extern void xchdir(char *dir);
+
+/* Relate absolute pathnames from and to returning the result in outpath. */
+extern int relatepaths(char *from, char *to, char *outpath);
+
+/* NOTE: changes current working directory -- caveat emptor */
+extern void reversepath(char *inpath, char *name, int len, char *outpath);
+
+/* stats every directory in path, reports results. */
+extern void diagnosePath(const char * path);
+
+#endif /* pathsub_h___ */
diff --git a/security/nss/coreconf/nsinstall/sunos4.h b/security/nss/coreconf/nsinstall/sunos4.h
new file mode 100644
index 0000000000..3ba064f98b
--- /dev/null
+++ b/security/nss/coreconf/nsinstall/sunos4.h
@@ -0,0 +1,134 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef pr_sunos4_h___
+#define pr_sunos4_h___
+
+#ifndef SVR4
+
+/*
+** Hodge podge of random missing prototypes for the Sunos4 system
+*/
+#include <stdio.h>
+#include <stdarg.h>
+#include <time.h>
+#include <limits.h>
+#include <sys/types.h>
+
+#define PATH_MAX _POSIX_PATH_MAX
+
+struct timeval;
+struct timezone;
+struct itimerval;
+struct sockaddr;
+struct stat;
+struct tm;
+
+/* ctype.h */
+extern int tolower(int);
+extern int toupper(int);
+
+/* errno.h */
+extern char *sys_errlist[];
+extern int sys_nerr;
+
+#define strerror(e) sys_errlist[((unsigned)(e) < sys_nerr) ? e : 0]
+
+extern void perror(const char *);
+
+/* getopt */
+extern char *optarg;
+extern int optind;
+extern int getopt(int argc, char **argv, char *spec);
+
+/* math.h */
+extern int srandom(long val);
+extern long random(void);
+
+/* memory.h */
+#define memmove(to,from,len) bcopy((char*)(from),(char*)(to),len)
+
+extern void bcopy(const char *, char *, int);
+
+/* signal.h */
+/*
+** SunOS4 sigaction hides interrupts by default, so we can safely define
+** SA_RESTART to 0 (HP-UX is a counter-example -- its sigaction does not
+** hide interrupts but lacks an SA_RESTART option; you must use sigvector
+** and tweak the sigcontext from within each signal handler!).
+*/
+#define SA_RESTART 0
+#define SA_SIGINFO 0
+
+/* stdio.h */
+extern int printf(const char *, ...);
+extern int fprintf(FILE *, const char *, ...);
+extern int vprintf(const char *, va_list);
+extern int vfprintf(FILE *, const char *, va_list);
+extern char *vsprintf(char *, const char *, va_list);
+extern int scanf(const char *, ...);
+extern int sscanf(const char *, const char *, ...);
+extern int fscanf(FILE *, const char *, ...);
+extern int fgetc(FILE *);
+extern int fputc(int, FILE *);
+extern int fputs(const char *, FILE *);
+extern int puts(const char *);
+extern int fread(void *, size_t, size_t, FILE *);
+extern int fwrite(const char *, int, int, FILE *);
+extern int fseek(FILE *, long, int);
+extern long ftell(FILE *);
+extern int rewind(FILE *);
+extern int fflush(FILE *);
+extern int _flsbuf(unsigned char, FILE *);
+extern int fclose(FILE *);
+extern int remove(const char *);
+extern int setvbuf(FILE *, char *, int, size_t);
+extern int system(const char *);
+extern FILE *popen(const char *, const char *);
+extern int pclose(FILE *);
+
+/* stdlib.h */
+#define strtoul strtol
+
+extern int isatty(int fildes);
+extern long strtol(const char *, char **, int);
+extern int putenv(const char *);
+extern void srand48(long);
+extern long lrand48(void);
+extern double drand48(void);
+
+/* string.h */
+extern int strcasecmp(const char *, const char *);
+extern int strncasecmp(const char *, const char *, size_t);
+extern int strcoll(const char *, const char *);
+
+/* time.h */
+extern time_t mktime(struct tm *);
+extern size_t strftime(char *, size_t, const char *, const struct tm *);
+extern int gettimeofday(struct timeval *, struct timezone *);
+extern int setitimer(int, struct itimerval *, struct itimerval *);
+extern time_t time(time_t *);
+extern time_t timegm(struct tm *);
+extern struct tm *localtime(const time_t *);
+extern struct tm *gmtime(const time_t *);
+
+/* unistd.h */
+extern int rename(const char *, const char *);
+extern int ioctl(int, int, int *arg);
+extern int connect(int, struct sockaddr *, int);
+extern int readlink(const char *, char *, int);
+extern int symlink(const char *, const char *);
+extern int ftruncate(int, off_t);
+extern int fchmod(int, mode_t);
+extern int fchown(int, uid_t, gid_t);
+extern int lstat(const char *, struct stat *);
+extern int fstat(int, struct stat *);
+extern int select(int, fd_set *, fd_set *, fd_set *, struct timeval *);
+extern int gethostname(char *, int);
+extern char *getwd(char *);
+extern int getpagesize(void);
+
+#endif /* SVR4 */
+
+#endif /* pr_sunos4_h___ */
diff --git a/security/nss/coreconf/nspr.sh b/security/nss/coreconf/nspr.sh
new file mode 100644
index 0000000000..d84674e0e0
--- /dev/null
+++ b/security/nss/coreconf/nspr.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# This script builds NSPR for NSS.
+#
+# This build system is still under development.  It does not yet support all
+# the features or platforms that the regular NSPR build supports.
+
+# variables
+nspr_cflags=
+nspr_cxxflags=
+nspr_ldflags=
+
+# Try to avoid bmake on OS X and BSD systems
+if hash gmake 2>/dev/null; then
+    make() { command gmake "$@"; }
+fi
+
+nspr_set_flags()
+{
+    nspr_cflags="$CFLAGS $@"
+    nspr_cxxflags="$CXXFLAGS $@"
+    nspr_ldflags="$LDFLAGS $@"
+}
+
+nspr_build()
+{
+    local nspr_dir="$cwd"/../nspr/$target
+    mkdir -p "$nspr_dir"
+
+    # These NSPR options are directory-specific, so they don't need to be
+    # included in nspr_opt and changing them doesn't force a rebuild of NSPR.
+    extra_params=(--prefix="$dist_dir"/$target)
+    if [ "$opt_build" = 1 ]; then
+        extra_params+=(--disable-debug --enable-optimize)
+    fi
+    if [ "$target_arch" = "x64" ]; then
+        extra_params+=(--enable-64bit)
+    fi
+
+    echo "NSPR [1/5] configure ..."
+    pushd "$nspr_dir" >/dev/null
+    CFLAGS="$nspr_cflags" CXXFLAGS="$nspr_cxxflags" \
+          LDFLAGS="$nspr_ldflags" CC="$CC" CXX="$CCC" \
+          run_verbose ../configure "${extra_params[@]}" "$@"
+    popd >/dev/null
+    echo "NSPR [2/5] make ..."
+    run_verbose make -C "$nspr_dir"
+
+    if [ "$build_nspr_tests" = 1 ]; then
+      echo "NSPR [3/5] build tests ..."
+      run_verbose make -C "$nspr_dir/pr/tests"
+    else
+        echo "NSPR [3/5] NOT building tests"
+    fi
+
+    if [[ "$build_nspr_tests" = 1 && "$run_nspr_tests" = 1 ]]; then
+      echo "NSPR [4/5] run tests ..."
+      run_verbose make -C "$nspr_dir/pr/tests" runtests
+    else
+        echo "NSPR [4/5] NOT running tests"
+    fi
+
+    echo "NSPR [5/5] install ..."
+    run_verbose make -C "$nspr_dir" install
+}
+
+nspr_clean()
+{
+    rm -rf "$cwd"/../nspr/$target
+}
+
+set_nspr_path()
+{
+    local include=$(echo "$1" | cut -d: -f1)
+    local lib=$(echo "$1" | cut -d: -f2)
+    gyp_params+=(-Dnspr_include_dir="$include")
+    gyp_params+=(-Dnspr_lib_dir="$lib")
+}
diff --git a/security/nss/coreconf/precommit.clang-format.sh b/security/nss/coreconf/precommit.clang-format.sh
new file mode 100755
index 0000000000..b638b298e5
--- /dev/null
+++ b/security/nss/coreconf/precommit.clang-format.sh
@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# This is a pre-commit hook for use with either mercurial or git.
+#
+# Install this by running the script with an argument of "install".
+#
+# All that does is add the following lines to .hg/hgrc:
+#
+# [hook]
+# pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh
+#
+# Or installs a symlink to .git/hooks/precommit:
+# $ ln -s ../../coreconf/precommit.clang-format.sh .git/hooks/pre-commit
+
+hash clang-format || exit 1
+[ "$(hg root 2>/dev/null)" = "$PWD" ] && hg=1 || hg=0
+[ "$(git rev-parse --show-toplevel 2>/dev/null)" = "$PWD" ] && git=1 || git=0
+
+if [ "$1" = "install" ]; then
+    if [ "$hg" -eq 1 ]; then
+        hgrc="$(hg root)"/.hg/hgrc
+        if ! grep -q '^pretxncommit.clang-format' "$hgrc"; then
+            echo '[hooks]' >> "$hgrc"
+            echo 'pretxncommit.clang-format = [ ! -x ./coreconf/precommit.clang-format.sh ] || ./coreconf/precommit.clang-format.sh' >> "$hgrc"
+            echo "Installed mercurial pretxncommit hook"
+            exit
+        fi
+    fi
+    if [ "$git" -eq 1 ]; then
+        hook="$(git rev-parse --show-toplevel)"/.git/hooks/pre-commit
+        if [ ! -e "$hook" ]; then
+            ln -s ../../coreconf/precommit.clang-format.sh "$hook"
+            echo "Installed git pre-commit hook"
+            exit
+        fi
+    fi
+    echo "Hook already installed, or not in NSS repo"
+    exit 2
+fi
+
+err=0
+files=()
+if [ "$hg" -eq 1 ]; then
+    files=($(hg status -m -a --rev tip^:tip | cut -f 2 -d ' ' -))
+fi
+if [ "$git" -eq 1 ]; then
+    files=($(git status --porcelain | sed '/^[MACU]/{s/..//;p;};/^R/{s/^.* -> //;p;};d'))
+fi
+tmp=$(mktemp)
+trap 'rm -f "$tmp"' ERR EXIT
+for f in "${files[@]}"; do
+    ext="${f##*.}"
+    if [ "$ext" = "c" -o "$ext" = "h" -o "$ext" = "cc" ]; then
+        [ "$hg" -eq 1 ] && hg cat -r tip "$f" > "$tmp"
+        [ "$git" -eq 1 ] && git show :"$f" > "$tmp"
+        if ! cat "$tmp" | clang-format -assume-filename="$f" | \
+            diff -q "$tmp" - >/dev/null; then
+            [ "$err" -eq 0 ] && echo "Formatting errors found in:" 1>&2
+            echo "  $f" 1>&2
+            err=1
+        fi
+    fi
+done
+exit "$err"
diff --git a/security/nss/coreconf/prefix.mk b/security/nss/coreconf/prefix.mk
new file mode 100644
index 0000000000..57e11e501f
--- /dev/null
+++ b/security/nss/coreconf/prefix.mk
@@ -0,0 +1,44 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" for computing program prefixes             #
+#######################################################################
+
+#
+# Object prefixes
+#
+
+ifndef OBJ_PREFIX
+    OBJ_PREFIX = 
+endif
+
+#
+# Library suffixes
+#
+
+ifndef LIB_PREFIX
+    LIB_PREFIX = lib
+endif
+
+
+ifndef DLL_PREFIX
+    DLL_PREFIX = lib
+endif
+
+
+ifndef IMPORT_LIB_PREFIX
+    IMPORT_LIB_PREFIX = 
+endif
+
+#
+# Program prefixes
+#
+
+ifndef PROG_PREFIX
+    PROG_PREFIX = 
+endif
+
+MK_PREFIX = included
diff --git a/security/nss/coreconf/rules.mk b/security/nss/coreconf/rules.mk
new file mode 100644
index 0000000000..a341b8385a
--- /dev/null
+++ b/security/nss/coreconf/rules.mk
@@ -0,0 +1,464 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+###                                                                 ###
+###              R U L E S   O F   E N G A G E M E N T              ###
+###                                                                 ###
+#######################################################################
+
+#######################################################################
+# Dont't use double-colon rules!                                      #
+#######################################################################
+
+ifndef HAVE_ALL_TARGET
+all: libs
+endif
+
+autobuild:
+ifeq ($(AUTOCLEAN),1)
+	$(MAKE) clean
+endif
+	$(MAKE) all
+	$(MAKE) install
+
+platform:
+	@echo $(OBJDIR_NAME)
+
+ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+USE_NT_C_SYNTAX=1
+endif
+
+# For whatever reason, "." can't be handled using make conditionals.
+# Based on automake's SUBDIRS "." handling.
+ifdef DIRS
+ifndef IGNORE_DIRS
+ifneq (,$(filter .,$(DIRS)))
+TARGETS = $(NULL)
+ALL_TRASH = $(NULL)
+endif
+
+$(DIRS):
+	$(IGNORE_ERROR)@if [ "$@" != "." ]; then \
+		$(MAKE) -C $@ $(MAKECMDGOALS) ; \
+	else \
+		IGNORE_DIRS=1 $(MAKE) -C $@ $(MAKECMDGOALS) ; \
+	fi
+	@$(CLICK_STOPWATCH)
+endif
+endif
+
+export: $(DIRS) private_export
+
+release_export: $(DIRS)
+
+libs program install: $(DIRS) $(TARGETS)
+ifneq ($(LIBRARY),)
+	$(INSTALL) -m 664 $(LIBRARY) $(SOURCE_LIB_DIR)
+endif
+ifneq ($(SHARED_LIBRARY),)
+	$(INSTALL) -m 775 $(SHARED_LIBRARY) $(SOURCE_LIB_DIR)
+ifdef MOZ_DEBUG_SYMBOLS
+ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+	$(INSTALL) -m 644 $(SHARED_LIBRARY:$(DLL_SUFFIX)=pdb) $(SOURCE_LIB_DIR)
+endif
+endif
+endif
+ifneq ($(IMPORT_LIBRARY),)
+	$(INSTALL) -m 775 $(IMPORT_LIBRARY) $(SOURCE_LIB_DIR)
+endif
+ifneq ($(PROGRAM),)
+	$(INSTALL) -m 775 $(PROGRAM) $(SOURCE_BIN_DIR)
+ifdef MOZ_DEBUG_SYMBOLS
+ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+	$(INSTALL) -m 644 $(PROGRAM:$(PROG_SUFFIX)=.pdb) $(SOURCE_BIN_DIR)
+endif
+endif
+endif
+ifneq ($(PROGRAMS),)
+	$(INSTALL) -m 775 $(PROGRAMS) $(SOURCE_BIN_DIR)
+endif
+
+check: $(DIRS)
+
+clean clobber: $(DIRS)
+ifneq (,$(ALL_TRASH))
+	rm -rf $(ALL_TRASH)
+endif
+
+realclean clobber_all: $(DIRS)
+	rm -rf $(wildcard *.OBJ) dist $(ALL_TRASH)
+
+release_clean:
+	rm -rf $(SOURCE_XP_DIR)/release/$(RELEASE_MD_DIR)
+
+release: release_clean release_export release_md
+
+ifndef NO_MD_RELEASE
+    ifdef LIBRARY
+        MD_LIB_RELEASE_FILES +=  $(LIBRARY)
+    endif
+    ifdef SHARED_LIBRARY
+        MD_LIB_RELEASE_FILES +=  $(SHARED_LIBRARY)
+    endif
+    ifdef IMPORT_LIBRARY
+        MD_LIB_RELEASE_FILES +=  $(IMPORT_LIBRARY)
+    endif
+    ifdef PROGRAM
+        MD_BIN_RELEASE_FILES +=  $(PROGRAM)
+    endif
+    ifdef PROGRAMS
+        MD_BIN_RELEASE_FILES +=  $(PROGRAMS)
+    endif
+endif
+
+release_md:: $(DIRS)
+ifneq ($(MD_LIB_RELEASE_FILES),)
+	$(INSTALL) -m 444 $(MD_LIB_RELEASE_FILES) $(SOURCE_RELEASE_PREFIX)/$(SOURCE_RELEASE_LIB_DIR)
+endif
+ifneq ($(MD_BIN_RELEASE_FILES),)
+	$(INSTALL) -m 555 $(MD_BIN_RELEASE_FILES) $(SOURCE_RELEASE_PREFIX)/$(SOURCE_RELEASE_BIN_DIR)
+endif
+
+alltags:
+	rm -f TAGS
+	find . -name dist -prune -o \( -name '*.[hc]' -o -name '*.cp' -o -name '*.cpp' \) -print | xargs etags -a
+	find . -name dist -prune -o \( -name '*.[hc]' -o -name '*.cp' -o -name '*.cpp' \) -print | xargs ctags -a
+
+.SECONDEXPANSION:
+%/d:
+	@$(MAKE_OBJDIR)
+
+define PROGRAM_template
+
+ifndef $(1)_OBJS
+ifdef LIBRARY_NAME
+	$(1)_OBJS := $$(patsubst $$(PROG_PREFIX)%,%,$$(patsubst %$$(PROG_SUFFIX),%,$(1)))$$(OBJ_SUFFIX)
+endif
+ifdef PROGRAMS
+	$(1)_OBJS := $$(patsubst $$(PROG_PREFIX)%,%,$$(patsubst %$$(PROG_SUFFIX),%,$(1)))$$(OBJ_SUFFIX)
+endif
+ifndef $(1)_OBJS
+	$(1)_OBJS := $$(OBJS)
+endif
+endif
+
+$(1): $$($(1)_OBJS) $$(EXTRA_LIBS) | $$$$(@D)/d
+	rm -f $$@
+ifeq (,$$(filter-out _WIN%,$$(NS_USE_GCC)_$$(OS_TARGET)))
+	$$(MKPROG) $$($(1)_OBJS) -Fe$$@ -link $$(LDFLAGS) $$(XLDFLAGS) $$(EXTRA_LIBS) $$(EXTRA_SHARED_LIBS) $$(OS_LIBS)
+ifdef MT
+	if test -f $$@.manifest; then \
+		$$(MT) -NOLOGO -MANIFEST $$@.manifest -OUTPUTRESOURCE:$$@\;1; \
+		rm -f $$@.manifest; \
+	fi
+endif	# MSVC with manifest tool
+else
+	$$(MKPROG) -o $$@ $$(CFLAGS) $$($(1)_OBJS) $$(LDFLAGS) $$(EXTRA_LIBS) $$(EXTRA_SHARED_LIBS) $$(OS_LIBS)
+endif
+endef # PROGRAM_template
+
+ifdef PROGRAM
+$(eval $(call PROGRAM_template,$(PROGRAM)))
+else
+ifdef PROGRAMS
+$(foreach prog,$(PROGRAMS),$(eval $(call PROGRAM_template,$(prog))))
+endif
+endif
+
+get_objs:
+	@echo $(OBJS)
+
+$(LIBRARY): $(OBJS) | $$(@D)/d
+	rm -f $@
+ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+	$(AR) $(subst /,\\,$(OBJS))
+else
+	$(AR) $(OBJS)
+endif
+	$(RANLIB) $@
+
+
+ifeq ($(OS_TARGET),OS2)
+$(IMPORT_LIBRARY): $(MAPFILE)
+	rm -f $@
+	$(IMPLIB) $@ $<
+	$(RANLIB) $@
+endif
+ifeq ($(OS_ARCH),WINNT)
+$(IMPORT_LIBRARY): $(SHARED_LIBRARY)
+endif
+
+ifdef SHARED_LIBRARY_LIBS
+ifdef BUILD_TREE
+SUB_SHLOBJS = $(foreach dir,$(SHARED_LIBRARY_DIRS),$(shell $(MAKE) -C $(dir) --no-print-directory get_objs))
+else
+SUB_SHLOBJS = $(foreach dir,$(SHARED_LIBRARY_DIRS),$(addprefix $(dir)/,$(shell $(MAKE) -C $(dir) --no-print-directory get_objs)))
+endif
+endif
+
+$(SHARED_LIBRARY): $(OBJS) $(RES) $(MAPFILE) $(SUB_SHLOBJS) | $$(@D)/d
+	rm -f $@
+ifeq ($(OS_TARGET)$(OS_RELEASE), AIX4.1)
+	echo "#!" > $(OBJDIR)/lib$(LIBRARY_NAME)_syms
+	nm -B -C -g $(OBJS) \
+	| awk '/ [T,D] / {print $$3}' \
+	| sed -e 's/^\.//' \
+	| sort -u >> $(OBJDIR)/lib$(LIBRARY_NAME)_syms
+	$(LD) $(XCFLAGS) -o $@ $(OBJS) -bE:$(OBJDIR)/lib$(LIBRARY_NAME)_syms \
+	-bM:SRE -bnoentry $(OS_LIBS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS)
+else
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ifdef NS_USE_GCC
+	$(LINK_DLL) $(OBJS) $(SUB_SHLOBJS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS) $(OS_LIBS) $(LD_LIBS) $(RES)
+else
+	$(LINK_DLL) -MAP $(DLLBASE) $(subst /,\\,$(OBJS) $(SUB_SHLOBJS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS) $(OS_LIBS) $(LD_LIBS) $(RES))
+ifdef MT
+	if test -f $@.manifest; then \
+		$(MT) -NOLOGO -MANIFEST $@.manifest -OUTPUTRESOURCE:$@\;2; \
+		rm -f $@.manifest; \
+	fi
+endif	# MSVC with manifest tool
+endif
+else
+	$(MKSHLIB) -o $@ $(OBJS) $(SUB_SHLOBJS) $(LD_LIBS) $(EXTRA_LIBS) $(EXTRA_SHARED_LIBS) $(OS_LIBS)
+	chmod +x $@
+endif
+endif
+
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+$(RES): $(RESNAME) | $$(@D)/d
+# The resource compiler does not understand the -U option.
+ifdef NS_USE_GCC
+	$(RC) $(filter-out -U%,$(DEFINES)) $(INCLUDES:-I%=--include-dir %) -o $@ $<
+else
+	$(RC) $(filter-out -U%,$(DEFINES)) $(INCLUDES) -Fo$@ $<
+endif
+	@echo $(RES) finished
+endif
+
+$(MAPFILE): $(MAPFILE_SOURCE) | $$(@D)/d
+	$(PROCESS_MAP_FILE)
+
+WCCFLAGS1 := $(subst /,\\,$(CFLAGS))
+WCCFLAGS2 := $(subst -I,-i=,$(WCCFLAGS1))
+WCCFLAGS3 := $(subst -D,-d,$(WCCFLAGS2))
+
+# Translate source filenames to absolute paths. This is required for
+# debuggers under Windows & OS/2 to find source files automatically
+
+ifeq (,$(filter-out OS2 AIX,$(OS_TARGET)))
+# OS/2 and AIX
+NEED_ABSOLUTE_PATH := 1
+PWD := $(shell pwd)
+
+else
+# Windows
+ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+NEED_ABSOLUTE_PATH := 1
+# CURDIR is always an absolute path. If it doesn't start with a /, it's a
+# Windows path meaning we're running under MINGW make (as opposed to MSYS
+# make), or pymake. In both cases, it's preferable to use a Windows path,
+# so use $(CURDIR) as is.
+ifeq (,$(filter /%,$(CURDIR)))
+PWD := $(CURDIR)
+else
+PWD := $(shell pwd)
+ifeq (,$(findstring ;,$(PATH)))
+ifndef USE_MSYS
+PWD := $(subst \,/,$(shell cygpath -w $(PWD)))
+endif
+endif
+endif
+
+else
+# everything else
+PWD := $(shell pwd)
+endif
+endif
+
+# The quotes allow absolute paths to contain spaces.
+core_abspath = '$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))'
+
+$(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.c | $$(@D)/d
+ifdef USE_NT_C_SYNTAX
+	$(CC) -Fo$@ -c $(CSTD) $(CFLAGS) $(call core_abspath,$<)
+else
+ifdef NEED_ABSOLUTE_PATH
+	$(CC) -o $@ -c $(CSTD) $(CFLAGS) $(call core_abspath,$<)
+else
+	$(CC) -o $@ -c $(CSTD) $(CFLAGS) $<
+endif
+endif
+
+$(PROG_PREFIX)%$(OBJ_SUFFIX): %.c | $$(@D)/d
+ifdef USE_NT_C_SYNTAX
+	$(CC) -Fo$@ -c $(CSTD) $(CFLAGS) $(call core_abspath,$<)
+else
+ifdef NEED_ABSOLUTE_PATH
+	$(CC) -o $@ -c $(CSTD) $(CFLAGS) $(call core_abspath,$<)
+else
+	$(CC) -o $@ -c $(CSTD) $(CFLAGS) $<
+endif
+endif
+
+ifneq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+$(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.s | $$(@D)/d
+	$(AS) -o $@ $(ASFLAGS) -c $<
+endif
+
+$(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.asm | $$(@D)/d
+	$(AS) -Fo$@ $(ASFLAGS) -c $<
+
+$(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.S | $$(@D)/d
+	$(AS) -o $@ $(ASFLAGS) -c $<
+
+$(OBJDIR)/$(PROG_PREFIX)%: %.cpp | $$(@D)/d
+ifdef USE_NT_C_SYNTAX
+	$(CCC) -Fo$@ -c $(CXXSTD) $(CFLAGS) $(CXXFLAGS) $(call core_abspath,$<)
+else
+ifdef NEED_ABSOLUTE_PATH
+	$(CCC) -o $@ -c $(CXXSTD) $(CFLAGS) $(CXXFLAGS) $(call core_abspath,$<)
+else
+	$(CCC) -o $@ -c $(CXXSTD) $(CFLAGS) $(CXXFLAGS) $<
+endif
+endif
+
+define compile_ccc_pattern_RULE
+
+$$(OBJDIR)/$$(PROG_PREFIX)%$$(OBJ_SUFFIX): %.$(1) | $$$$(@D)/d
+ifdef STRICT_CPLUSPLUS_SUFFIX
+	echo "#line 1 \"$$<\"" | cat - $$< > $$(OBJDIR)/t_$$*.cc
+	$$(CCC) -o $$@ -c $$(CXXSTD) $$(CFLAGS) $$(CXXFLAGS) $$(OBJDIR)/t_$$*.cc
+	rm -f $$(OBJDIR)/t_$$*.cc
+else
+ifdef USE_NT_C_SYNTAX
+	$$(CCC) -Fo$$@ -c $$(CXXSTD) $$(CFLAGS) $$(CXXFLAGS) $$(call core_abspath,$$<)
+else
+ifdef NEED_ABSOLUTE_PATH
+	$$(CCC) -o $$@ -c $$(CXXSTD) $$(CFLAGS) $$(CXXFLAGS) $$(call core_abspath,$$<)
+else
+	$$(CCC) -o $$@ -c $$(CXXSTD) $$(CFLAGS) $$(CXXFLAGS) $$<
+endif
+endif
+endif #STRICT_CPLUSPLUS_SUFFIX
+endef # compile_ccc_pattern_RULE
+
+$(eval $(call compile_ccc_pattern_RULE,cc))
+$(eval $(call compile_ccc_pattern_RULE,cpp))
+
+%.i: %.cpp
+	$(CCC) -C -E $(CFLAGS) $(CXXFLAGS) $< > $@
+
+%.i: %.c
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+	$(CC) -C /P $(CFLAGS) $< 
+else
+	$(CC) -C -E $(CFLAGS) $< > $@
+endif
+
+ifneq (,$(filter-out WIN%,$(OS_TARGET)))
+%.i: %.s
+	$(CC) -C -E $(CFLAGS) $< > $@
+endif
+
+%: %.pl
+	rm -f $@; cp $< $@; chmod +x $@
+
+%: %.sh
+	rm -f $@; cp $< $@; chmod +x $@
+
+define copy_varlist_into_dir_RULE
+ifdef $(2)
+ifneq (,$$(strip $$($(2))))
+$(3)/%: %
+	$$(INSTALL) -m 444 $$^ $(3)
+
+$(1): $$(addprefix $(3)/,$$($(2))) | $(3)/d
+
+.NOTPARALLEL: $(1)
+endif
+else
+$(1):
+endif
+endef # copy_varlist_into_dir_RULE
+
+# export rule
+$(eval $(call copy_varlist_into_dir_RULE,export,EXPORTS,$(SOURCE_XPHEADERS_DIR)))
+
+# private_export rule
+$(eval $(call copy_varlist_into_dir_RULE,private_export,PRIVATE_EXPORTS,$(SOURCE_XPPRIVATE_DIR)))
+
+##########################################################################
+###   RULES FOR RUNNING REGRESSION SUITE TESTS
+###   REQUIRES 'REGRESSION_SPEC' TO BE SET TO THE NAME OF A REGRESSION SPECFILE
+###   AND RESULTS_SUBDIR TO BE SET TO SOMETHING LIKE SECURITY/PKCS5
+##########################################################################
+
+TESTS_DIR = $(RESULTS_DIR)/$(RESULTS_SUBDIR)/$(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(IMPL_STRATEGY)
+
+ifneq ($(REGRESSION_SPEC),)
+
+ifneq ($(BUILD_OPT),)
+REGDATE = $(subst \ ,, $(shell $(PERL)  $(CORE_DEPTH)/$(MODULE)/scripts/now))
+endif
+
+check: $(REGRESSION_SPEC) | $(TESTS_DIR)/d
+	cd $(PLATFORM); \
+	../$(SOURCE_MD_DIR)/bin/regress$(PROG_SUFFIX) specfile=../$(REGRESSION_SPEC) progress $(EXTRA_REGRESS_OPTIONS)
+ifneq ($(BUILD_OPT),)
+	$(NSINSTALL) -m 664 $(PLATFORM)/$(REGDATE).sum $(TESTS_DIR); \
+	$(NSINSTALL) -m 664 $(PLATFORM)/$(REGDATE).htm $(TESTS_DIR); \
+	echo "Please now make sure your results files are copied to $(TESTS_DIR), "; \
+	echo "then run 'reporter specfile=$(RESULTS_DIR)/rptspec'"
+endif
+else
+check:
+	@echo "Error: you didn't specify REGRESSION_SPEC in your manifest.mn file!"
+endif
+
+# release_export rule
+$(eval $(call copy_varlist_into_dir_RULE,release_export,EXPORTS,$(SOURCE_RELEASE_XP_DIR)/include))
+
+#
+# HACK ALERT
+#
+# The only purpose of this rule is to pass Mozilla's Tinderbox depend
+# builds (http://tinderbox.mozilla.org/showbuilds.cgi).  Mozilla's
+# Tinderbox builds NSS continuously as part of the Mozilla client.
+# Because NSS's make depend is not implemented, whenever we change
+# an NSS header file, the depend build does not recompile the NSS
+# files that depend on the header.
+#
+# This rule makes all the objects depend on a dummy header file.
+# Check in a change to this dummy header file to force the depend
+# build to recompile everything.
+#
+# This rule should be removed when make depend is implemented.
+#
+
+DUMMY_DEPEND = $(CORE_DEPTH)/coreconf/coreconf.dep
+
+$(filter $(OBJDIR)/%$(OBJ_SUFFIX),$(OBJS)): $(OBJDIR)/%$(OBJ_SUFFIX): $(DUMMY_DEPEND)
+
+# END OF HACK
+
+################################################################################
+# Special gmake rules.
+################################################################################
+
+#
+# Re-define the list of default suffixes, so gmake won't have to churn through
+# hundreds of built-in suffix rules for stuff we don't need.
+#
+.SUFFIXES:
+.SUFFIXES: .out .a .ln .o .obj .c .cc .C .cpp .y .l .s .S .h .sh .i .pl .html .asm .dep
+
+#
+# Fake targets.  Always run these rules, even if a file/directory with that
+# name already exists.
+#
+.PHONY: all all_platforms alltags boot clean clobber clobber_all export install libs program realclean release $(DIRS)
+
diff --git a/security/nss/coreconf/ruleset.mk b/security/nss/coreconf/ruleset.mk
new file mode 100644
index 0000000000..01207cdcd4
--- /dev/null
+++ b/security/nss/coreconf/ruleset.mk
@@ -0,0 +1,179 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+#                                                                     #
+# Parameters to this makefile (set these in this file):               #
+#                                                                     #
+# a)                                                                  #
+#	TARGETS	-- the target to create                               #
+#			(defaults to $LIBRARY $PROGRAM)               #
+# b)                                                                  #
+#	DIRS	-- subdirectories for make to recurse on              #
+#			(the 'all' rule builds $TARGETS $DIRS)        #
+# c)                                                                  #
+#	CSRCS, CPPSRCS -- .c and .cpp files to compile                #
+#			(used to define $OBJS)                        #
+# d)                                                                  #
+#	PROGRAM	-- the target program name to create from $OBJS       #
+#			($OBJDIR automatically prepended to it)       #
+# e)                                                                  #
+#	LIBRARY	-- the target library name to create from $OBJS       #
+#			($OBJDIR automatically prepended to it)       #
+#                                                                     #
+#######################################################################
+
+#
+# CPU_TAG is now defined in the $(TARGET).mk files
+#
+
+ifndef COMPILER_TAG
+    ifneq ($(DEFAULT_COMPILER), $(notdir $(firstword $(CC))))
+#
+# Temporary define for the Client; to be removed when binary release is used
+#
+	ifdef MOZILLA_CLIENT
+	    COMPILER_TAG =
+	else
+	    COMPILER_TAG = _$(notdir $(firstword $(CC)))
+	endif
+    else
+	COMPILER_TAG =
+    endif
+endif
+
+ifeq ($(MKPROG),)
+    MKPROG = $(CC)
+endif
+
+#
+# This makefile contains rules for building the following kinds of
+# objects:
+# - (1) LIBRARY: a static (archival) library
+# - (2) SHARED_LIBRARY: a shared (dynamic link) library
+# - (3) IMPORT_LIBRARY: an import library, defined in $(OS_TARGET).mk
+# - (4) PROGRAM: an executable binary
+#
+# A library is build by specifying the LIBRARY_NAME variable.
+# If you want to build only a static library, set SHARED_LIBRARY = $(NULL)
+# If you want to build only a shared library, set LIBRARY = $(NULL)
+# You can specify the shared library major version via LIBRARY_VERSION.
+#
+# Normally you want to link to the shared library. In this case you must
+# provide an export script, like:
+#   MAPFILE = $(OBJDIR)/$(LIBRARY_NAME).def.
+# Unfortunatly this variable is needed by the ARCH setup, so you have to set
+# it explicitly in the manifest.mn.
+#
+# Per default, it's assumed the shared library provides resource specification
+# in the file RES. You can set it to $(NULL), if that is not true.
+#
+# If you have an unversioned SHARED_LIBRARY, you must explicitly change or
+# disable the static LIBRARY, as these normally clash on Windows.
+
+ifdef LIBRARY_NAME
+    ifndef LIBRARY
+	LIBRARY := $(OBJDIR)/$(LIB_PREFIX)$(LIBRARY_NAME).$(LIB_SUFFIX)
+    endif
+    ifndef SHARED_LIBRARY
+	SHARED_LIBRARY := $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+    endif
+
+    ifneq ($(SHARED_LIBRARY),)
+
+    ifdef IMPORT_LIB_SUFFIX
+    ifdef MAPFILE
+    ifndef IMPORT_LIBRARY
+	IMPORT_LIBRARY := $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+    endif
+    endif
+    endif
+
+    ifndef MAPFILE_SOURCE
+	MAPFILE_SOURCE := $(LIBRARY_NAME).def
+    endif
+
+    ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+    ifndef RES
+	RES := $(OBJDIR)/$(LIBRARY_NAME).res
+    endif
+    ifndef RESNAME
+	RESNAME := $(LIBRARY_NAME).rc
+    endif
+    endif
+
+    endif
+endif
+
+#
+# Common rules used by lots of makefiles...
+#
+
+ifdef PROGRAM
+    PROGRAM := $(addprefix $(OBJDIR)/, $(PROGRAM)$(PROG_SUFFIX))
+endif
+
+ifdef PROGRAMS
+    PROGRAMS := $(addprefix $(OBJDIR)/, $(PROGRAMS:%=%$(PROG_SUFFIX)))
+endif
+
+ifndef TARGETS
+    TARGETS = $(LIBRARY) $(SHARED_LIBRARY) $(PROGRAM)
+endif
+
+# Make both .cpp and .cc work.
+CPPSRCS1 = $(CPPSRCS:.cpp=$(OBJ_SUFFIX))
+CPPSRCS2 = $(CPPSRCS1:.cc=$(OBJ_SUFFIX))
+
+ifndef OBJS
+    SIMPLE_OBJS = \
+		$(CSRCS:.c=$(OBJ_SUFFIX)) \
+		$(CPPSRCS2) \
+		$(ASFILES:$(ASM_SUFFIX)=$(OBJ_SUFFIX)) \
+		$(BUILT_CSRCS:.c=$(OBJ_SUFFIX)) \
+		$(BUILT_CPPSRCS:.cpp=$(OBJ_SUFFIX)) \
+		$(BUILT_ASFILES:$(ASM_SUFFIX)=$(OBJ_SUFFIX))
+    OBJS =	$(addprefix $(OBJDIR)/$(PROG_PREFIX), $(SIMPLE_OBJS))
+endif
+
+ifndef BUILT_SRCS
+    BUILT_SRCS = $(addprefix $(OBJDIR)/$(PROG_PREFIX), \
+		 $(BUILT_CSRCS) $(BUILT_CPPSRCS) $(BUILT_ASFILES))
+endif
+
+ifndef MAKE_OBJDIR
+define MAKE_OBJDIR
+if test ! -d $(@D); then $(NSINSTALL) -D $(@D); fi
+endef
+endif
+
+ALL_TRASH =	$(TARGETS) $(OBJS) $(OBJDIR) LOGS TAGS $(GARBAGE) \
+		so_locations $(BUILT_SRCS) $(NOSUCHFILE)
+
+ifdef NSS_BUILD_CONTINUE_ON_ERROR
+# Try to build everything. I.e., don't exit on errors.
+    EXIT_ON_ERROR		= +e
+    IGNORE_ERROR		= -
+    CLICK_STOPWATCH		= date
+else
+    EXIT_ON_ERROR		= -e
+    IGNORE_ERROR		=
+    CLICK_STOPWATCH		= true
+endif
+
+ifdef REQUIRES
+    MODULE_INCLUDES := $(addprefix -I$(SOURCE_XP_DIR)/public/, $(REQUIRES))
+    INCLUDES        += $(MODULE_INCLUDES)
+    ifeq ($(MODULE), sectools)
+	PRIVATE_INCLUDES := $(addprefix -I$(SOURCE_XP_DIR)/private/, $(REQUIRES))
+	INCLUDES         += $(PRIVATE_INCLUDES)
+    endif
+endif
+
+ifdef SYSTEM_INCL_DIR
+    YOPT = -Y$(SYSTEM_INCL_DIR)
+endif
+
+MK_RULESET = included
diff --git a/security/nss/coreconf/sanitizers.py b/security/nss/coreconf/sanitizers.py
new file mode 100644
index 0000000000..48fd148c45
--- /dev/null
+++ b/security/nss/coreconf/sanitizers.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python2
+
+from __future__ import print_function
+import sys
+
+def main():
+    if len(sys.argv) < 2:
+        raise Exception('Specify either "asan", "fuzzer", "msan", "sancov", "sourcecov" or "ubsan" as argument.')
+
+    sanitizer = sys.argv[1]
+    if sanitizer == "ubsan":
+        if len(sys.argv) < 3:
+            raise Exception('ubsan requires another argument.')
+        print('-fsanitize='+sys.argv[2]+' -fno-sanitize-recover='+sys.argv[2] + ' ', end='')
+        print('-fno-sanitize=nonnull-attribute -fno-sanitize=enum ', end='')
+        return
+    if sanitizer == "asan":
+        print('-fsanitize=address -fsanitize-address-use-after-scope ', end='')
+        print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
+        return
+    if sanitizer == "msan":
+        print('-fsanitize=memory -fsanitize-memory-track-origins ', end='')
+        print('-fno-omit-frame-pointer -fno-optimize-sibling-calls ', end='')
+        return
+    if sanitizer == "sancov":
+        if len(sys.argv) < 3:
+            raise Exception('sancov requires another argument (edge|bb|func).')
+        print('-fsanitize-coverage='+sys.argv[2]+' ', end='')
+        return
+    if sanitizer == "sourcecov":
+        print('-fprofile-instr-generate -fcoverage-mapping', end='')
+        return
+    if sanitizer == "fuzzer":
+        print('-fsanitize=fuzzer-no-link ', end='')
+        return
+
+    raise Exception('Specify either "asan", "fuzzer", "msan", "sancov", "sourcecov" or "ubsan" as argument.')
+
+if __name__ == '__main__':
+    main()
diff --git a/security/nss/coreconf/sanitizers.sh b/security/nss/coreconf/sanitizers.sh
new file mode 100644
index 0000000000..6d7b617734
--- /dev/null
+++ b/security/nss/coreconf/sanitizers.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# This file is used by build.sh to setup sanitizers.
+
+sanitizer_flags=""
+sanitizers=()
+
+# This tracks what sanitizers are enabled so they don't get enabled twice.  This
+# means that doing things that enable the same sanitizer twice (such as enabling
+# both --asan and --fuzz) is order-dependent: only the first is used.
+enable_sanitizer()
+{
+    local san="$1"
+    for i in "${sanitizers[@]}"; do
+        [ "$san" = "$i" ] && return
+    done
+    sanitizers+=("$san")
+
+    if [ -z "$sanitizer_flags" ]; then
+        gyp_params+=(-Dno_zdefs=1)
+    fi
+
+    local cflags=$(python $cwd/coreconf/sanitizers.py "$@")
+    sanitizer_flags="$sanitizer_flags $cflags"
+}
+
+enable_sancov()
+{
+    local clang_version=$($CC --version | grep -oE '([0-9]{1,}\.)+[0-9]{1,}')
+    if [[ ${clang_version:0:1} -lt 4 && ${clang_version:0:1} -eq 3 && ${clang_version:2:1} -lt 9 ]]; then
+        echo "Need at least clang-3.9 (better 4.0) for sancov." 1>&2
+        exit 1
+    fi
+
+    local sancov
+    if [ -n "$1" ]; then
+        sancov="$1"
+    elif [ "${clang_version:0:3}" = "3.9" ]; then
+        sancov=edge,indirect-calls,8bit-counters
+    else
+        sancov=trace-pc-guard,trace-cmp
+    fi
+    enable_sanitizer sancov "$sancov"
+}
+
+enable_sourcecov()
+{
+    enable_sanitizer sourcecov
+}
+
+enable_ubsan()
+{
+    local ubsan
+    if [ -n "$1" ]; then
+        ubsan="$1"
+    else
+        ubsan=undefined,local-bounds
+    fi
+    enable_sanitizer ubsan "$ubsan"
+}
+
+# Not strictly a sanitizer, but the pattern fits
+scanbuild=()
+enable_scanbuild()
+{
+    [ "${#scanbuild[@]}" -gt 0 ] && return
+
+    scanbuild=(scan-build)
+    if [ -n "$1" ]; then
+        scanbuild+=(-o "$1")
+    fi
+    # pass on CC and CCC to scanbuild
+    if [ -n "$CC" ]; then
+        scanbuild+=(--use-cc="$CC")
+    fi
+    if [ -n "$CCC" ]; then
+        scanbuild+=(--use-c++="$CCC")
+    fi
+}
+
+run_scanbuild()
+{
+    "${scanbuild[@]}" "$@"
+}
diff --git a/security/nss/coreconf/shlibsign.py b/security/nss/coreconf/shlibsign.py
new file mode 100644
index 0000000000..dc40a8c89b
--- /dev/null
+++ b/security/nss/coreconf/shlibsign.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python2
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+import os
+import subprocess
+import sys
+
+def main():
+    for lib_file in sys.argv[1:]:
+        if os.path.isfile(lib_file):
+            sign(lib_file)
+
+def sign(lib_file):
+    ld_lib_path = os.path.realpath(os.path.join(lib_file, '..'))
+    bin_path = os.path.realpath(os.path.join(ld_lib_path, '../bin'))
+
+    env = os.environ.copy()
+    if sys.platform == 'win32':
+        env['PATH'] = os.pathsep.join((env['PATH'], ld_lib_path))
+    else:
+        env['LD_LIBRARY_PATH'] = env['DYLD_LIBRARY_PATH'] = ld_lib_path
+
+    dev_null = open(os.devnull, 'wb')
+    subprocess.check_call([os.path.join(bin_path, 'shlibsign'), '-v', '-i', lib_file], env=env, stdout=dev_null, stderr=dev_null)
+
+if __name__ == '__main__':
+    main()
diff --git a/security/nss/coreconf/source.mk b/security/nss/coreconf/source.mk
new file mode 100644
index 0000000000..94c383e4c1
--- /dev/null
+++ b/security/nss/coreconf/source.mk
@@ -0,0 +1,128 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master <component>-specific source import/export directories        #
+#######################################################################
+
+#
+# <user_source_tree> master import/export directory prefix
+#
+
+ifndef SOURCE_PREFIX
+    ifndef BUILD_TREE
+	SOURCE_PREFIX = $(CORE_DEPTH)/../dist
+    else
+	SOURCE_PREFIX = $(BUILD_TREE)/dist
+    endif
+endif
+
+#
+# <user_source_tree> cross-platform (xp) master import/export directory
+#
+
+ifndef SOURCE_XP_DIR
+    SOURCE_XP_DIR        = $(SOURCE_PREFIX)
+endif
+
+#
+# <user_source_tree> cross-platform (xp) import/export directories
+#
+
+SOURCE_XPHEADERS_DIR   = $(SOURCE_XP_DIR)/public/$(MODULE)
+SOURCE_XPPRIVATE_DIR   = $(SOURCE_XP_DIR)/private/$(MODULE)
+
+#
+# <user_source_tree> machine-dependent (md) master import/export directory
+#
+
+ifndef SOURCE_MD_DIR
+    SOURCE_MD_DIR        = $(SOURCE_PREFIX)/$(PLATFORM)
+endif
+
+#
+# <user_source_tree> machine-dependent (md) import/export directories
+#
+
+#This is where we install built executables and (for Windows only) DLLs.
+ifndef SOURCE_BIN_DIR
+    SOURCE_BIN_DIR       = $(SOURCE_MD_DIR)/bin
+endif
+
+#This is where we install built libraries (.a, .so, .lib).
+ifndef SOURCE_LIB_DIR
+    SOURCE_LIB_DIR       = $(SOURCE_MD_DIR)/lib
+endif
+
+# This is where NSPR header files are found.
+ifndef SOURCE_MDHEADERS_DIR
+    SOURCE_MDHEADERS_DIR = $(SOURCE_MD_DIR)/include
+endif
+
+#######################################################################
+# Master <component>-specific source release directories and files    #
+#######################################################################
+
+#
+# <user_source_tree> source-side master release directory prefix
+# NOTE:  export control policy enforced for XP and MD files released to
+#        the staging area
+#
+
+ifeq ($(POLICY), domestic)
+    SOURCE_RELEASE_PREFIX = $(SOURCE_PREFIX)/release/domestic
+else
+    ifeq ($(POLICY), export)
+	SOURCE_RELEASE_PREFIX = $(SOURCE_PREFIX)/release/export
+    else
+	ifeq ($(POLICY), france)
+	    SOURCE_RELEASE_PREFIX = $(SOURCE_PREFIX)/release/france
+	else
+#We shouldn't have to put another directory under here, but without it the perl
+#script for releasing doesn't find the directory. It thinks it doesn't exist.
+#So we're adding this no-policy directory so that the script for releasing works
+#in all casese when policy is not set. This doesn't affect where the final jar
+#files land, only where they are placed in the local tree when building the jar
+#files. When there is no policy, the jar files will still land in
+#<dist>/<module>/<date>/<platform> like they used to.
+	    SOURCE_RELEASE_PREFIX = $(SOURCE_PREFIX)/release/no-policy
+	endif
+    endif
+endif
+
+#
+# <user_source_tree> cross-platform (xp) source-side master release directory
+#
+
+SOURCE_RELEASE_XP_DIR = $(SOURCE_RELEASE_PREFIX)
+
+#
+# <user_source_tree> cross-platform (xp) source-side release directories
+#
+
+SOURCE_RELEASE_XPHEADERS_DIR   = include
+
+#
+# <user_source_tree> machine-dependent (md) source-side master release directory
+#
+
+SOURCE_RELEASE_MD_DIR = $(PLATFORM)
+
+#
+# <user_source_tree> machine-dependent (md) source-side release directories
+#
+
+SOURCE_RELEASE_BIN_DIR       = $(PLATFORM)/bin
+SOURCE_RELEASE_LIB_DIR       = $(PLATFORM)/lib
+SOURCE_RELEASE_MDHEADERS_DIR = $(PLATFORM)/include
+SOURCE_RELEASE_SPEC_DIR      = $(SOURCE_RELEASE_MD_DIR)
+
+# Where to put the results
+
+ifneq ($(RESULTS_DIR),)
+    RESULTS_DIR = $(RELEASE_TREE)/sectools/results
+endif
+
+MK_SOURCE = included
diff --git a/security/nss/coreconf/suffix.mk b/security/nss/coreconf/suffix.mk
new file mode 100644
index 0000000000..8050e4ac52
--- /dev/null
+++ b/security/nss/coreconf/suffix.mk
@@ -0,0 +1,62 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" suffixes                                   #
+#######################################################################
+
+#
+# Object suffixes   (OS2 and WIN% override this)
+#
+ifndef OBJ_SUFFIX
+    OBJ_SUFFIX = .o
+endif
+
+#
+# Assembler source suffixes (OS2 and WIN% override this)
+#
+ifndef ASM_SUFFIX
+    ASM_SUFFIX = .s
+endif
+
+#
+# Library suffixes
+#
+STATIC_LIB_EXTENSION =
+
+ifndef DYNAMIC_LIB_EXTENSION
+    DYNAMIC_LIB_EXTENSION =
+endif
+
+
+ifndef STATIC_LIB_SUFFIX
+    STATIC_LIB_SUFFIX = .$(LIB_SUFFIX)
+endif
+
+
+ifndef DYNAMIC_LIB_SUFFIX
+    DYNAMIC_LIB_SUFFIX = .$(DLL_SUFFIX)
+endif
+
+
+ifndef STATIC_LIB_SUFFIX_FOR_LINKING
+    STATIC_LIB_SUFFIX_FOR_LINKING = $(STATIC_LIB_SUFFIX)
+endif
+
+
+# WIN% overridese this
+ifndef DYNAMIC_LIB_SUFFIX_FOR_LINKING
+    DYNAMIC_LIB_SUFFIX_FOR_LINKING = $(DYNAMIC_LIB_SUFFIX)
+endif
+
+#
+# Program suffixes (OS2 and WIN% override this)
+#
+
+ifndef PROG_SUFFIX
+    PROG_SUFFIX =
+endif
+
+MK_SUFFIX = included
diff --git a/security/nss/coreconf/tree.mk b/security/nss/coreconf/tree.mk
new file mode 100644
index 0000000000..f819abfef5
--- /dev/null
+++ b/security/nss/coreconf/tree.mk
@@ -0,0 +1,52 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Master "Core Components" file system "release" prefixes             #
+#######################################################################
+
+# Windows platforms override this.  See WIN32.mk.
+ifndef RELEASE_TREE
+    ifdef BUILD_SHIP
+	ifdef USE_SHIPS 
+	    RELEASE_TREE = $(BUILD_SHIP)
+	else
+	    RELEASE_TREE = /share/builds/components
+	endif
+    else
+	RELEASE_TREE = /share/builds/components
+    endif
+endif
+
+#
+# NOTE:  export control policy enforced for XP and MD files
+#        released to the binary release tree
+#
+
+ifeq ($(POLICY), domestic)
+    RELEASE_XP_DIR = domestic
+    RELEASE_MD_DIR = domestic/$(PLATFORM)
+else
+    ifeq ($(POLICY), export)
+	RELEASE_XP_DIR = export
+	RELEASE_MD_DIR = export/$(PLATFORM)
+    else
+	ifeq ($(POLICY), france)
+	    RELEASE_XP_DIR = france
+	    RELEASE_MD_DIR = france/$(PLATFORM)
+	else
+	    RELEASE_XP_DIR = 
+	    RELEASE_MD_DIR = $(PLATFORM)
+	endif
+    endif
+endif
+
+
+REPORTER_TREE = $(subst \,\\,$(RELEASE_TREE))
+
+IMPORT_XP_DIR = 
+IMPORT_MD_DIR = $(PLATFORM)
+
+MK_TREE = included
diff --git a/security/nss/coreconf/version.mk b/security/nss/coreconf/version.mk
new file mode 100644
index 0000000000..5e2964e390
--- /dev/null
+++ b/security/nss/coreconf/version.mk
@@ -0,0 +1,73 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#######################################################################
+# Build master "Core Components" release version directory name       #
+#######################################################################
+
+#
+# Always set CURRENT_VERSION_SYMLINK to the <current> symbolic link.
+#
+
+CURRENT_VERSION_SYMLINK = current
+
+
+#
+#  For the sake of backwards compatibility (*sigh*) ...
+#
+
+ifndef VERSION
+    ifdef BUILD_NUM
+	VERSION = $(BUILD_NUM)
+    endif
+endif
+
+ifndef RELEASE_VERSION
+    ifdef BUILD_NUM
+	RELEASE_VERSION = $(BUILD_NUM)
+    endif
+endif
+
+#
+# If VERSION has still NOT been set on the command line,
+# as an environment variable, by the individual Makefile, or
+# by the <component>-specific "version.mk" file, set VERSION equal
+# to $(CURRENT_VERSION_SYMLINK).
+
+ifndef VERSION
+    VERSION = $(CURRENT_VERSION_SYMLINK)
+endif
+
+# If RELEASE_VERSION has still NOT been set on the command line,
+# as an environment variable, by the individual Makefile, or
+# by the <component>-specific "version.mk" file, automatically
+# generate the next available version number via a perl script.
+# 
+
+ifndef RELEASE_VERSION
+    RELEASE_VERSION = 
+endif
+
+#
+# Set <component>-specific versions for compiliation and linkage.
+#
+
+ifndef NETLIB_VERSION
+    NETLIB_VERSION = $(CURRENT_VERSION_SYMLINK)
+endif
+
+ifndef NSPR_VERSION
+    NSPR_VERSION = $(CURRENT_VERSION_SYMLINK)
+endif
+
+ifndef SECTOOLS_VERSION
+    SECTOOLS_VERSION = $(CURRENT_VERSION_SYMLINK)
+endif
+
+ifndef SECURITY_VERSION
+    SECURITY_VERSION = $(CURRENT_VERSION_SYMLINK)
+endif
+
+MK_VERSION = included
diff --git a/security/nss/coreconf/version.pl b/security/nss/coreconf/version.pl
new file mode 100644
index 0000000000..d2a494289b
--- /dev/null
+++ b/security/nss/coreconf/version.pl
@@ -0,0 +1,48 @@
+#!/usr/sbin/perl
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Compose lowercase alphabet
+@alphabet = ( "a", "b", "c", "d", "e", "f", "g", "h",
+              "i", "j", "k", "l", "m", "n", "o", "p",
+              "q", "r", "s", "t", "u", "v", "w", "x",
+              "y", "z" );
+
+# Compute year
+$year = (localtime)[5] + 1900;
+
+# Compute month
+$month = (localtime)[4] + 1;
+
+# Compute day
+$day = (localtime)[3];
+
+# Compute base build number
+$version = sprintf( "%d%02d%02d", $year, $month, $day );
+$directory = sprintf( "%s\/%s\/%d%02d%02d", $ARGV[0], $ARGV[1], $year, $month, $day );
+
+# Print out the name of the first version directory which does not exist
+#if( ! -e  $directory )
+#{
+    print $version;
+#}
+#else
+#{
+#    # Loop through combinations
+#    foreach $ch1 (@alphabet)
+#    {
+#	foreach $ch2 (@alphabet)
+#	{
+#	    $version = sprintf( "%d%02d%02d%s%s", $year, $month, $day, $ch1, $ch2 );
+#	    $directory = sprintf( "%s\/%s\/%d%02d%02d%s%s", $ARGV[0], $ARGV[1], $year, $month, $day, $ch1, $ch2 );
+#	    if( ! -e  $directory )
+#	    {
+#		print STDOUT $version;
+#		exit;
+#	    }
+#	}
+#    }
+#}
+
diff --git a/security/nss/coreconf/werror.py b/security/nss/coreconf/werror.py
new file mode 100644
index 0000000000..2f622c5e11
--- /dev/null
+++ b/security/nss/coreconf/werror.py
@@ -0,0 +1,80 @@
+#!/usr/bin/env python
+
+import os
+import subprocess
+
+def main():
+    cc = os.environ.get('CC', 'cc')
+    sink = open(os.devnull, 'wb')
+    try:
+        cc_is_clang = 'clang' in subprocess.check_output(
+          [cc, '--version'], universal_newlines=True, stderr=sink)
+    except OSError:
+        # We probably just don't have CC/cc.
+        return
+
+    def warning_supported(warning):
+        return subprocess.call([cc, '-x', 'c', '-E', '-Werror',
+                                '-W%s' % warning, os.devnull], stdout=sink, stderr=sink) == 0
+    def can_enable():
+        # This would be a problem
+        if not warning_supported('all'):
+            return False
+
+        # If we aren't clang, make sure we have gcc 4.8 at least
+        if not cc_is_clang:
+            try:
+                v = subprocess.check_output([cc, '-dumpversion'], stderr=sink).decode("utf-8")
+                v = v.strip(' \r\n').split('.')
+                v = list(map(int, v))
+                if v[0] < 4 or (v[0] == 4 and v[1] < 8):
+                    # gcc 4.8 minimum
+                    return False
+            except OSError:
+                return False
+        return True
+
+    if not can_enable():
+        print('-DNSS_NO_GCC48')
+        return
+
+    print('-Werror')
+    print('-Wall')
+
+    def set_warning(warning, contra=''):
+        if warning_supported(warning):
+            print('-W%s%s' % (contra, warning))
+
+    if cc_is_clang:
+        # clang is unable to handle glib's expansion of strcmp and similar for
+        # optimized builds, so disable the resulting errors.
+        # See https://llvm.org/bugs/show_bug.cgi?id=20144
+        for w in ['array-bounds',
+                  'unevaluated-expression',
+                  'parentheses-equality',
+                  'tautological-type-limit-compare',
+                  'sign-compare',
+                  'comma',
+                  'implicit-fallthrough'
+                  ]:
+            set_warning(w, 'no-')
+        for w in ['tautological-constant-in-range-compare',
+                  'bitfield-enum-conversion',
+                  'empty-body',
+                  'format-type-confusion',
+                  'ignored-qualifiers',
+                  'pointer-arith',
+                  'type-limits',
+                  'unreachable-code',
+                  'unreachable-code-return',
+                  'duplicated-cond',
+                  'logical-op',
+                  'implicit-function-declaration'
+                  ]:
+            set_warning(w,'')
+        print('-Qunused-arguments')
+
+    set_warning('shadow')
+
+if __name__ == '__main__':
+    main()
diff --git a/security/nss/coreconf/zlib.mk b/security/nss/coreconf/zlib.mk
new file mode 100644
index 0000000000..a8504b78c5
--- /dev/null
+++ b/security/nss/coreconf/zlib.mk
@@ -0,0 +1,17 @@
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# Configuration information for linking against zlib.
+
+# If a platform has a system zlib, set USE_SYSTEM_ZLIB to 1 and
+# ZLIB_LIBS to the linker command-line arguments for the system zlib
+# (for example, -lz) in the platform's config file in coreconf.
+ifdef USE_SYSTEM_ZLIB
+OS_LIBS += $(ZLIB_LIBS)
+else
+ZLIB_LIBS = $(DIST)/lib/$(LIB_PREFIX)zlib.$(LIB_SUFFIX)
+EXTRA_LIBS += $(ZLIB_LIBS)
+endif
+