The NSPR and NSS sources in mozilla-central are maintained by the NSPR and NSS teams and always taken from exports of HG tags. Do not check in individual changes. If you check in an individual change by mistake, your change will be lost when the NSPR and NSS teams push a new HG tag to mozilla-central.

(Because some developers might not be aware that NSPR/NSS are separately maintained and released, the Mozilla HG server rejects accidental changes/forking, if the required keywords are missing in the commit comment.)

If NSPR or NSS must be upgraded to a new static tag, follow this procedure:

  1. Before starting, make sure your local repository is updated to mozilla-central tip and that there are no local changes:
    $ hg status -mard
  2. Pull the new sources
    $ python client.py update_nspr NSPR_TAG_NAME

    or

    $ python client.py update_nss NSS_TAG_NAME
  3. If you update a branch older than Mozilla 17 (without the change from bug 782784), you must manually add a dummy change (add or remove a blank line) to force a rebuild of NSPR:
    mozilla/nsprpub/config/prdepend.h

    or NSS:

    mozilla/security/nss/coreconf/coreconf.dep
  4. Check directory mozilla/nsprpub/patches/ for patches that need to be applied to NSPR, and directory mozilla/security/patches/ for patches that need to be applied to NSS. Apply the patches. If merging is required, update the patch file. If a patch is no longer needed, remove the patch from the directory and update the README file.
  5. Check for new or removed files
    $ hg addremove -n

    Review the output to make sure it looks correct

  6. Update the minimum required system NSS version in old-configure.in. This is for builds with --with-system-nss. For example, in the following, "3.16.1" would be replaced with the new NSS version.

    MOZ_ARG_WITH_BOOL(system-nss,
    [  --with-system-nss       Use system installed NSS],
        _USE_SYSTEM_NSS=1 )
    
    if test -n "$_USE_SYSTEM_NSS"; then
        AM_PATH_NSS(3.16.1, [MOZ_NATIVE_NSS=1], [AC_MSG_ERROR([you don't have NSS installed or your version is too old])])
    fi
    
  7. Commit the update:
    $ hg commit -A
    

    In order to eliminate any problems related to how NSS and NSPR are built differently in Firefox than they are standalone, you should push your commit to Try first. If your update fails linking because of missing NSS or NSPR symbols, add the missing symbols to config/external/nss/nspr-dummy.def or config/external/nss/nss.def, whichever is relevant.
    In your commit message, include the required keywords, UPGRADE_NSPR_RELEASE and/or UPGRADE_NSS_RELEASE.

  8. Push the update:
    $ hg push