fdo#70393: move nss to a subdir of external

Change-Id: Ibbeb6b284c6c5fb9bba4ad52abed69321bba90d8
Reviewed-on: https://gerrit.libreoffice.org/6545
Reviewed-by: David Tardon <dtardon@redhat.com>
Tested-by: David Tardon <dtardon@redhat.com>

17 files changed, 1625 insertions, 0 deletions

diff --git a/external/Module_external.mk b/external/Module_external.mk
index 2547160110b9..8321a2e9023e 100644
--- a/external/Module_external.mk
+++ b/external/Module_external.mk
@@ -63,6 +63,7 @@ $(eval $(call gb_Module_add_moduledirs,external,\
 	$(call gb_Helper_optional,MYSQLCPPCONN,mysqlcppconn) \
 	$(call gb_Helper_optional,MYTHES,mythes) \
 	$(call gb_Helper_optional,NEON,neon) \
+	$(call gb_Helper_optional,NSS,nss) \
 	$(call gb_Helper_optional,ODFGEN,libodfgen) \
 	$(call gb_Helper_optional,ORCUS,liborcus) \
 	$(call gb_Helper_optional,VISIO,libvisio) \
@@ -73,6 +74,7 @@ $(eval $(call gb_Module_add_moduledirs,external,\
 		$(if $(filter YES,$(WITH_GALLERY_BUILD)), \
 			$(call gb_Helper_optional,HARFBUZZ,harfbuzz) \
 			$(call gb_Helper_optional,LCMS2,lcms2) \
+			$(call gb_Helper_optional,NSS,nss) \
 		) \
 	) \
 ))
diff --git a/external/nss/ExternalPackage_nss.mk b/external/nss/ExternalPackage_nss.mk
new file mode 100644
index 000000000000..054c7977984f
--- /dev/null
+++ b/external/nss/ExternalPackage_nss.mk
@@ -0,0 +1,60 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_ExternalPackage_ExternalPackage,nss,nss))
+
+$(eval $(call gb_ExternalPackage_use_external_project,nss,nss))
+
+ifeq ($(OS),MACOSX)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		mozilla/dist/out/lib/libfreebl3.dylib \
+		mozilla/dist/out/lib/libnspr4.dylib \
+		mozilla/dist/out/lib/libnss3.dylib \
+		mozilla/dist/out/lib/libnssckbi.dylib \
+		mozilla/dist/out/lib/libnssdbm3.dylib \
+		mozilla/dist/out/lib/libnssutil3.dylib \
+		mozilla/dist/out/lib/libplc4.dylib \
+		mozilla/dist/out/lib/libplds4.dylib \
+		mozilla/dist/out/lib/libsmime3.dylib \
+		mozilla/dist/out/lib/libsoftokn3.dylib \
+		mozilla/dist/out/lib/libssl3.dylib \
+))
+else ifeq ($(OS),WNT)
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		mozilla/dist/out/lib/freebl3.dll \
+		mozilla/dist/out/lib/nspr4.dll \
+		mozilla/dist/out/lib/nss3.dll \
+		mozilla/dist/out/lib/nssckbi.dll \
+		mozilla/dist/out/lib/nssdbm3.dll \
+		mozilla/dist/out/lib/nssutil3.dll \
+		mozilla/dist/out/lib/plc4.dll \
+		mozilla/dist/out/lib/plds4.dll \
+		mozilla/dist/out/lib/smime3.dll \
+		mozilla/dist/out/lib/softokn3.dll \
+		mozilla/dist/out/lib/sqlite3.dll \
+		mozilla/dist/out/lib/ssl3.dll \
+))
+else # OS!=WNT/MACOSX
+$(eval $(call gb_ExternalPackage_add_files,nss,$(LIBO_LIB_FOLDER),\
+		mozilla/dist/out/lib/libfreebl3.so \
+		mozilla/dist/out/lib/libnspr4.so \
+		mozilla/dist/out/lib/libnss3.so \
+		mozilla/dist/out/lib/libnssckbi.so \
+		mozilla/dist/out/lib/libnssdbm3.so \
+		mozilla/dist/out/lib/libnssutil3.so \
+		mozilla/dist/out/lib/libplc4.so \
+		mozilla/dist/out/lib/libplds4.so \
+		mozilla/dist/out/lib/libsmime3.so \
+		mozilla/dist/out/lib/libsoftokn3.so \
+		mozilla/dist/out/lib/libssl3.so \
+		mozilla/dist/out/lib/libsqlite3.so \
+))
+endif
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/nss/ExternalProject_nss.mk b/external/nss/ExternalProject_nss.mk
new file mode 100644
index 000000000000..af354e517763
--- /dev/null
+++ b/external/nss/ExternalProject_nss.mk
@@ -0,0 +1,87 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_ExternalProject_ExternalProject,nss))
+
+$(eval $(call gb_ExternalProject_register_targets,nss,\
+	configure \
+	build \
+))
+
+$(call gb_ExternalProject_get_state_target,nss,configure):
+	$(call gb_ExternalProject_run,configure,\
+	$(if $(filter MSC,$(COM)),LIB="$(ILIB)") \
+	mozilla/nsprpub/configure --includedir=$(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/include \
+		$(if $(filter YES,$(CROSS_COMPILING)),--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM)) \
+		$(if $(filter MSCX,$(COM)$(CPU)),--enable-64bit) \
+	,,nss_configure.log)
+
+ifeq ($(OS),WNT)
+ifeq ($(COM),MSC)
+$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python)
+	$(call gb_ExternalProject_run,build,\
+		$(if $(MSVC_USE_DEBUG_RUNTIME),USE_DEBUG_RTL=1,BUILD_OPT=1) \
+		MOZ_MSVCVERSION=9 OS_TARGET=WIN95 \
+		$(if $(filter X,$(CPU)),USE_64=1) \
+		LIB="$(ILIB)" \
+		XCFLAGS="$(SOLARINC)" \
+		$(MAKE) -j1 nss_build_all RC="rc.exe $(SOLARINC)" \
+			NSINSTALL='$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py' \
+	,mozilla/security/nss)
+
+
+else
+$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python)
+	$(call gb_ExternalProject_run,build,\
+		$(MAKE) -j1 nss_build_all \
+			NS_USE_GCC=1 \
+			CC="$(CC) $(if $(filter YES,$(MINGW_SHARED_GCCLIB)),-shared-libgcc)" \
+			CXX="$(CXX) $(if $(filter YES,$(MINGW_SHARED_GCCLIB)),-shared-libgcc)" \
+			OS_LIBS="-ladvapi32 -lws2_32 -lmswsock -lwinmm $(if $(filter YES,$(MINGW_SHARED_GXXLIB)),$(MINGW_SHARED_LIBSTDCPP))" \
+			LDFLAGS="" \
+			PATH="$(PATH)" \
+			RANLIB="$(RANLIB)" \
+			OS_TARGET=WINNT RC="$(WINDRES)" OS_RELEASE="5.0" \
+			IMPORT_LIB_SUFFIX=dll.a \
+			NSPR_CONFIGURE_OPTS="--build=$(BUILD_PLATFORM) --host=$(HOST_PLATFORM) --enable-shared --disable-static" \
+			NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py" \
+		&& rm -f $(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/lib/*.a \
+	,mozilla/security/nss)
+
+endif
+else # OS!=WNT
+$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalProject_get_state_target,nss,configure) $(call gb_ExternalExecutable_get_dependencies,python)
+	$(call gb_ExternalProject_run,build,\
+		$(if $(filter FREEBSD LINUX MACOSX,$(OS)),$(if $(filter X,$(CPU)),USE_64=1)) \
+		$(if $(filter MACOSX,$(OS)),MACOS_SDK_DIR=$(MACOSX_SDK_PATH) \
+			NSS_USE_SYSTEM_SQLITE=1) \
+		$(if $(filter SOLARIS,$(OS)),NS_USE_GCC=1) \
+		$(if $(filter YES,$(CROSS_COMPILING)),\
+		NSINSTALL="$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py") \
+		NSDISTMODE=copy \
+		$(MAKE) -j1 AR=$(AR) RANLIB=$(RANLIB) NMEDIT=$(NM)edit nss_build_all \
+		&& rm -f $(call gb_UnpackedTarball_get_dir,nss)/mozilla/dist/out/lib/*.a \
+		$(if $(filter MACOSX,$(OS)),&& $(PERL) \
+			$(SRCDIR)/solenv/bin/macosx-change-install-names.pl shl OOO \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libfreebl3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libnspr4.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libnss3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libnssckbi.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libnssdbm3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libnssutil3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libplc4.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libplds4.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libsmime3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libsoftokn3.dylib \
+			$(gb_Package_SOURCEDIR_nss)/mozilla/dist/out/lib/libssl3.dylib) \
+	,mozilla/security/nss)
+
+endif
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/nss/Makefile b/external/nss/Makefile
new file mode 100644
index 000000000000..e4968cf85fb6
--- /dev/null
+++ b/external/nss/Makefile
@@ -0,0 +1,7 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+
+module_directory:=$(dir $(realpath $(firstword $(MAKEFILE_LIST))))
+
+include $(module_directory)/../../solenv/gbuild/partial_build.mk
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/nss/Module_nss.mk b/external/nss/Module_nss.mk
new file mode 100644
index 000000000000..c1619ffb14d3
--- /dev/null
+++ b/external/nss/Module_nss.mk
@@ -0,0 +1,22 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_Module_Module,nss))
+
+ifeq ($(SYSTEM_NSS),NO)
+ifeq ($(filter ANDROID IOS,$(OS)),)
+$(eval $(call gb_Module_add_targets,nss,\
+	UnpackedTarball_nss \
+	ExternalPackage_nss \
+	ExternalProject_nss \
+))
+endif
+endif
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/nss/README b/external/nss/README
new file mode 100644
index 000000000000..77bc8172c976
--- /dev/null
+++ b/external/nss/README
@@ -0,0 +1,77 @@
+Contains the security libraries which are also part of [[moz]]. However nss is meant to be more current.
+
+== Relation between nss, moz, moz_prebuilt ==
+
+nss contains the security libraries which are also part of moz. However nss is
+meant to be more current, that is it to be updated more often. This should be
+easier than doing this with moz.
+
+If nss is built depends on an environment variable (SYSTEM_NSS=NO) which
+is per default set to YES. In this case nss is build before moz. The nss
+libraries/lib files/headers built in moz are then not delivered. Otherwise they
+would overwrite those from nss. That is, the nss libraries build in moz are
+removed from mozruntime.zip (build in moz/solver/bin), they are removed from the
+lib directory (for example moz/unxlngi6.pro/lib), and the nss and nspr headers
+are also removed (inc/nss and inc/nspr).  The nss libraries from the nss module
+are then added to mozruntime.zip.
+
+This also applies for moz_prebuilt. Therefore moz and moz_prebuilt must be build
+again after changes have been made to the libraries in the nss module.
+
+Also when moz was updated to use a newer version of mozilla, then one must make
+sure that new files which also belong to nss are not delivered and are removed
+from mozruntime.zip.
+
+
+== Fips 140 and signed libraries ==
+
+Fips 140 mode is not supported. That is, the *.chk files containing the
+checksums for the cryptographic module are not delivered into solver and will
+not be part of the OOo installation sets.
+
+Signing has been turned off because
+- we change the rpath (install names)  after signing which breaks the signatures
+(Mac)
+- sqlite conflicts with the system sqlite when signing which breaks the build
+
+
+== libfreebl3 ==
+
+Porting to other platforms may require to deliver other variants of
+libfreebl*. The library name varies according to the platform. Changes need to
+be made to
+ooo/moz/extractfiles.mk
+ooo/moz/zipped/makefile.mk
+sun/moz_prebuilt/zipped/makefile.mk
+
+See also
+[http://www.mozilla.org/projects/security/pki/nss/tech-notes/tn6.html]
+
+
+== Windows builds of nss ==
+
+To build mozilla on windows you'll need the mozilla build tools
+
+Build requirements containing the link to the build tools:
+[https://developer.mozilla.org/en/Windows_Build_Prerequisites#ss2.2]
+
+The direct link:
+[http://ftp.mozilla.org/pub/mozilla.org/mozilla/libraries/win32/MozillaBuildSetup-1.3.exe]
+
+
+== libsqlite3 ==
+
+The system sqlite in Mac OS X versions older than 10.6 is incompatible
+with the softokn3 in nss which requires a later version of sqlite.
+Since the baseline is Mac OS X 10.6 we use
+NSS_USE_SYSTEM_SQLITE=1
+to build using the system sqlite.
+
+The problem described here was found on Mac with OS 10.6
+We cannot deliver sqlite in the lib directory of the solver. This directory is
+used by tools of the build environment. Using the sqlite from NSS breaks the
+tools if they use system libraries which are linked with the system
+sqlite. Therefore we deliver it into lib/sqlite on unix systems.
+
+See also issue:
+[https://issues.apache.org/ooo/show_bug.cgi?id=106132]
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
new file mode 100644
index 000000000000..529f2fd61e08
--- /dev/null
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -0,0 +1,26 @@
+# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
+#
+# This file is part of the LibreOffice project.
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+#
+
+$(eval $(call gb_UnpackedTarball_UnpackedTarball,nss))
+
+$(eval $(call gb_UnpackedTarball_set_tarball,nss,$(NSS_TARBALL)))
+
+$(eval $(call gb_UnpackedTarball_add_patches,nss,\
+	external/nss/nss.patch \
+	external/nss/nss.aix.patch \
+	external/nss/nss-3.13.5-zlib-werror.patch \
+	$(if $(filter MACOSX,$(OS)),external/nss/nss_macosx.patch) \
+	$(if $(filter WNTMSC,$(OS)$(COM)),external/nss/nss.windows.patch) \
+	$(if $(filter WNTGCC,$(OS)$(COM)),external/nss/nspr-4.9-build.patch.3 \
+	external/nss/nss-3.13.3-build.patch.3 \
+	external/nss/nss.mingw.patch.3) \
+	external/nss/nss.wheader-guard.patch.0 \
+))
+
+# vim: set noet sw=4 ts=4:
diff --git a/external/nss/nsinstall.py b/external/nss/nsinstall.py
new file mode 100644
index 000000000000..31b3de3450c5
--- /dev/null
+++ b/external/nss/nsinstall.py
@@ -0,0 +1,164 @@
+# ***** BEGIN LICENSE BLOCK *****
+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
+#
+# The contents of this file are subject to the Mozilla Public License Version
+# 1.1 (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+# http://www.mozilla.org/MPL/
+#
+# Software distributed under the License is distributed on an "AS IS" basis,
+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+# for the specific language governing rights and limitations under the
+# License.
+#
+# The Original Code is Mozilla.
+#
+# The Initial Developer of the Original Code is
+# the Mozilla Foundation.
+# Portions created by the Initial Developer are Copyright (C) 2007
+# the Initial Developer. All Rights Reserved.
+#
+# Contributor(s):
+#   Axel Hecht <axel@pike.org>
+#
+# Alternatively, the contents of this file may be used under the terms of
+# either the GNU General Public License Version 2 or later (the "GPL"), or
+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+# in which case the provisions of the GPL or the LGPL are applicable instead
+# of those above. If you wish to allow use of your version of this file only
+# under the terms of either the GPL or the LGPL, and not to allow others to
+# use your version of this file under the terms of the MPL, indicate your
+# decision by deleting the provisions above and replace them with the notice
+# and other provisions required by the GPL or the LGPL. If you do not delete
+# the provisions above, a recipient may use your version of this file under
+# the terms of any one of the MPL, the GPL or the LGPL.
+#
+# ***** END LICENSE BLOCK *****
+
+# This is a partial python port of nsinstall.
+# It's intended to be used when there's no natively compile nsinstall
+# available, and doesn't intend to be fully equivalent.
+# Its major use is for l10n repackaging on systems that don't have
+# a full build environment set up.
+# The basic limitation is, it doesn't even try to link and ignores
+# all related options.
+
+from optparse import OptionParser
+import os
+import os.path
+import sys
+import shutil
+
+def nsinstall(argv):
+  usage = "usage: %prog [options] arg1 [arg2 ...] target-directory"
+  p = OptionParser(usage=usage)
+
+  p.add_option('-D', action="store_true",
+               help="Create a single directory only")
+  p.add_option('-t', action="store_true",
+               help="Preserve time stamp")
+  p.add_option('-m', action="store",
+               help="Set mode", metavar="mode")
+  p.add_option('-d', action="store_true",
+               help="Create directories in target")
+  p.add_option('-R', action="store_true",
+               help="Use relative symbolic links (ignored)")
+  p.add_option('-l', action="store_true",
+               help="Create link (ignored)")
+  p.add_option('-L', action="store", metavar="linkprefix",
+               help="Link prefix (ignored)")
+
+  # The remaining arguments are not used in our tree, thus they're not
+  # implented.
+  def BadArg(option, opt, value, parser):
+    parser.error('option not supported: %s' % opt)
+    
+  p.add_option('-C', action="callback", metavar="CWD",
+               callback=BadArg,
+               help="NOT SUPPORTED")
+  p.add_option('-o', action="callback", callback=BadArg,
+               help="Set owner (NOT SUPPORTED)", metavar="owner")
+  p.add_option('-g', action="callback", callback=BadArg,
+               help="Set group (NOT SUPPORTED)", metavar="group")
+
+  (options, args) = p.parse_args(argv)
+
+  if options.m:
+    # mode is specified
+    try:
+      options.m = int(options.m, 8)
+      # I have no idea why nss insists on using this mode for installed headers.
+      # It causes problems with updating the files during a rebuild.
+      if options.m == 0o444:
+        options.m = 0o644
+    except:
+      sys.stderr.write('nsinstall: ' + options.m + ' is not a valid mode\n')
+      return 1
+
+  # just create one directory?
+  if options.D:
+    if len(args) != 1:
+      return 1
+    if os.path.exists(args[0]):
+      if not os.path.isdir(args[0]):
+        sys.stderr.write('nsinstall: ' + args[0] + ' is not a directory\n')
+        sys.exit(1)
+      if options.m:
+        os.chmod(args[0], options.m)
+      sys.exit()
+    if options.m:
+      os.makedirs(args[0], options.m)
+    else:
+      os.makedirs(args[0])
+    return 0
+
+  # nsinstall arg1 [...] directory
+  if len(args) < 2:
+    p.error('not enough arguments')
+
+  def copy_all_entries(entries, target):
+    for e in entries:
+      dest = os.path.join(target,
+                          os.path.basename(os.path.normpath(e)))
+      handleTarget(e, dest)
+      if options.m:
+        os.chmod(dest, options.m)
+
+  # set up handler
+  if options.d:
+    # we're supposed to create directories
+    def handleTarget(srcpath, targetpath):
+      # target directory was already created, just use mkdir
+      os.mkdir(targetpath)
+  else:
+    # we're supposed to copy files
+    def handleTarget(srcpath, targetpath):
+      if os.path.isdir(srcpath):
+        if not os.path.exists(targetpath):
+          os.mkdir(targetpath)
+        entries = [os.path.join(srcpath, e) for e in os.listdir(srcpath)]
+        copy_all_entries(entries, targetpath)
+        # options.t is not relevant for directories
+        if options.m:
+          os.chmod(targetpath, options.m)
+      elif options.t:
+        if os.path.exists(targetpath):
+          os.remove(targetpath)
+        shutil.copy2(srcpath, targetpath)
+      else:
+        if os.path.exists(targetpath):
+          os.chmod(targetpath, 0o755)
+          os.remove(targetpath)
+        shutil.copy(srcpath, targetpath)
+
+  # the last argument is the target directory
+  target = args.pop()
+  # ensure target directory
+  if not os.path.isdir(target):
+    os.makedirs(target)
+
+  copy_all_entries(args, target)
+  return 0
+
+if __name__ == '__main__':
+  sys.exit(nsinstall(sys.argv[1:]))
diff --git a/external/nss/nspr-4.9-build.patch.3 b/external/nss/nspr-4.9-build.patch.3
new file mode 100644
index 000000000000..1ed211a803a6
--- /dev/null
+++ b/external/nss/nspr-4.9-build.patch.3
@@ -0,0 +1,285 @@
+---  misc/build/nss-3.13.5/mozilla/nsprpub/config/autoconf.mk.in	2011-08-29 19:02:51.000000000 +0200
++++  misc/build/nss-3.13.5/mozilla/nsprpub/config/autoconf.mk.in	2012-03-22 11:24:22.137097336 +0100
+@@ -27,6 +27,7 @@
+ OBJ_SUFFIX	= $(error config/config.mk needs to be included before using OBJ_SUFFIX)
+ _OBJ_SUFFIX	= @OBJ_SUFFIX@
+ LIB_SUFFIX	= @LIB_SUFFIX@
++IMPORT_LIB_SUFFIX = @IMPORT_LIB_SUFFIX@
+ DLL_SUFFIX	= @DLL_SUFFIX@
+ ASM_SUFFIX	= @ASM_SUFFIX@
+ MOD_NAME	= @NSPR_MODNAME@
+---  misc/build/nss-3.13.5/mozilla/nsprpub/config/rules.mk	2011-08-29 19:02:51.000000000 +0200
++++  misc/build/nss-3.13.5/mozilla/nsprpub/config/rules.mk	2012-03-22 11:24:22.138097311 +0100
+@@ -115,21 +115,21 @@
+ #
+ 
+ ifdef LIBRARY_NAME
+-ifeq (,$(filter-out WINNT WINCE OS2,$(OS_ARCH)))
++ifeq (,$(filter-out Linux WIN95 WINNT WINCE OS2,$(OS_ARCH)))
+ 
+ #
+ # Win95 and OS/2 require library names conforming to the 8.3 rule.
+ # other platforms do not.
+ #
+-ifeq (,$(filter-out WIN95 WINCE WINMO OS2,$(OS_TARGET)))
++ifeq (,$(filter-out WIN95 WINCE WINMO WINNT OS2,$(OS_TARGET)))
+ LIBRARY		= $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION)_s.$(LIB_SUFFIX)
+ SHARED_LIBRARY	= $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY	= $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).$(LIB_SUFFIX)
++IMPORT_LIBRARY	= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ SHARED_LIB_PDB	= $(OBJDIR)/$(LIBRARY_NAME)$(LIBRARY_VERSION).pdb
+ else
+ LIBRARY		= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION)_s.$(LIB_SUFFIX)
+ SHARED_LIBRARY	= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY	= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(LIB_SUFFIX)
++IMPORT_LIBRARY	= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ SHARED_LIB_PDB	= $(OBJDIR)/lib$(LIBRARY_NAME)$(LIBRARY_VERSION).pdb
+ endif
+ 
+---  misc/build/nss-3.13.5/mozilla/nsprpub/configure	2012-02-14 20:06:00.000000000 +0100
++++  misc/build/nss-3.13.5/mozilla/nsprpub/configure	2012-03-22 11:24:22.139097286 +0100
+@@ -3034,6 +3034,7 @@
+ 
+ OBJ_SUFFIX=o
+ LIB_SUFFIX=a
++IMPORT_LIB_SUFFIX=$IMPORT_LIB_SUFFIX
+ DLL_SUFFIX=so
+ ASM_SUFFIX=s
+ MKSHLIB='$(LD) $(DSO_LDOPTS) -o $@'
+@@ -4536,6 +4537,7 @@
+         CC="$CC -mwindows"
+         CXX="$CXX -mwindows"
+         DLL_SUFFIX=dll
++	IMPORT_LIB_SUFFIX=dll.a
+         MKSHLIB='$(CC) -shared -Wl,--export-all-symbols -Wl,--out-implib -Wl,$(IMPORT_LIBRARY) $(DLLBASE) -o $(subst $(OBJDIR)/,,$(SHARED_LIBRARY))'
+         RC=$WINDRES
+         # Use temp file for windres (bug 213281)
+@@ -4552,6 +4554,7 @@
+         GARBAGE='$(OBJDIR)/vc20.pdb $(OBJDIR)/vc40.pdb'
+         OBJ_SUFFIX=obj
+         LIB_SUFFIX=lib
++        IMPORT_LIB_SUFFIX=lib
+         DLL_SUFFIX=dll
+ 
+         # Determine compiler version
+@@ -4661,11 +4664,11 @@
+         
+         if test "$OS_TARGET" = "WINNT"; then
+             CFLAGS="$CFLAGS -GT"
+-            LIBNSPR='$(dist_libdir)/libnspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-            LIBPLC='$(dist_libdir)/libplc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++            LIBNSPR='$(dist_libdir)/libnspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++            LIBPLC='$(dist_libdir)/libplc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+         else
+-            LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-            LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++            LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++            LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+         fi
+     fi # GNU_CC
+ 
+@@ -4775,6 +4778,7 @@
+ 
+     OBJ_SUFFIX=obj
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     MKSHLIB='$(LD) -DLL $(DSO_LDOPTS) -OUT:$@'
+ 
+@@ -4782,8 +4786,8 @@
+     RESOLVE_LINK_SYMBOLS=1
+ 
+     MDCPUCFG_H=_win95.cfg
+-    LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-    LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++    LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++    LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+ 
+     DLLFLAGS='-OUT:"$@"'
+     if test -n "$MOZ_DEBUG_SYMBOLS"; then
+@@ -5584,6 +5588,7 @@
+ 
+     USE_PTHREADS=1
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     MKSHLIB=
+     DSO_LDOPTS=
+@@ -5668,6 +5673,7 @@
+ EOF
+ 
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     RC=rc.exe
+     PR_MD_ARCH_DIR=os2
+@@ -6966,6 +6972,7 @@
+ s%@CPU_ARCH@%$CPU_ARCH%g
+ s%@OBJ_SUFFIX@%$OBJ_SUFFIX%g
+ s%@LIB_SUFFIX@%$LIB_SUFFIX%g
++s%@IMPORT_LIB_SUFFIX@%$IMPORT_LIB_SUFFIX%g
+ s%@DLL_SUFFIX@%$DLL_SUFFIX%g
+ s%@ASM_SUFFIX@%$ASM_SUFFIX%g
+ s%@WRAP_LDFLAGS@%$WRAP_LDFLAGS%g
+---  misc/build/nss-3.13.5/mozilla/nsprpub/configure.in	2012-02-14 20:06:00.000000000 +0100
++++  misc/build/nss-3.13.5/mozilla/nsprpub/configure.in	2012-03-22 11:24:22.139097286 +0100
+@@ -834,6 +834,7 @@
+ dnl ========================================================
+ OBJ_SUFFIX=o
+ LIB_SUFFIX=a
++IMPORT_LIB_SUFFIX=$(IMPORT_LIB_SUFFIX)
+ DLL_SUFFIX=so
+ ASM_SUFFIX=s
+ MKSHLIB='$(LD) $(DSO_LDOPTS) -o $@'
+@@ -1901,6 +1902,7 @@
+         CC="$CC -mwindows"
+         CXX="$CXX -mwindows"
+         DLL_SUFFIX=dll
++	IMPORT_LIB_SUFFIX=dll.a
+         MKSHLIB='$(CC) -shared -Wl,--export-all-symbols -Wl,--out-implib -Wl,$(IMPORT_LIBRARY) $(DLLBASE) -o $(subst $(OBJDIR)/,,$(SHARED_LIBRARY))'
+         RC=$WINDRES
+         # Use temp file for windres (bug 213281)
+@@ -1917,6 +1919,7 @@
+         GARBAGE='$(OBJDIR)/vc20.pdb $(OBJDIR)/vc40.pdb'
+         OBJ_SUFFIX=obj
+         LIB_SUFFIX=lib
++        IMPORT_LIB_SUFFIX=lib
+         DLL_SUFFIX=dll
+ 
+         # Determine compiler version
+@@ -2014,11 +2017,11 @@
+         
+         if test "$OS_TARGET" = "WINNT"; then
+             CFLAGS="$CFLAGS -GT"
+-            LIBNSPR='$(dist_libdir)/libnspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-            LIBPLC='$(dist_libdir)/libplc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++            LIBNSPR='$(dist_libdir)/libnspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++            LIBPLC='$(dist_libdir)/libplc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+         else
+-            LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-            LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++            LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++            LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+         fi
+     fi # GNU_CC
+ 
+@@ -2089,6 +2092,7 @@
+ 
+     OBJ_SUFFIX=obj
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     MKSHLIB='$(LD) -DLL $(DSO_LDOPTS) -OUT:$@'
+ 
+@@ -2096,8 +2100,8 @@
+     RESOLVE_LINK_SYMBOLS=1
+ 
+     MDCPUCFG_H=_win95.cfg
+-    LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
+-    LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(LIB_SUFFIX)'
++    LIBNSPR='$(dist_libdir)/nspr$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
++    LIBPLC='$(dist_libdir)/plc$(MOD_MAJOR_VERSION).$(IMPORT_LIB_SUFFIX)'
+ 
+     DLLFLAGS='-OUT:"$@"'
+     if test -n "$MOZ_DEBUG_SYMBOLS"; then
+@@ -2576,6 +2580,7 @@
+     AC_DEFINE(HAVE_SOCKLEN_T)
+     USE_PTHREADS=1
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     MKSHLIB=
+     DSO_LDOPTS=
+@@ -2630,6 +2635,7 @@
+     AC_DEFINE(BSD_SELECT)
+     AC_DEFINE(TCPV40HDRS)
+     LIB_SUFFIX=lib
++    IMPORT_LIB_SUFFIX=lib
+     DLL_SUFFIX=dll
+     RC=rc.exe
+     PR_MD_ARCH_DIR=os2
+@@ -3291,6 +3297,7 @@
+ 
+ AC_SUBST(OBJ_SUFFIX)
+ AC_SUBST(LIB_SUFFIX)
++AC_SUBST(IMPORT_LIB_SUFFIX)
+ AC_SUBST(DLL_SUFFIX)
+ AC_SUBST(ASM_SUFFIX)
+ AC_SUBST(WRAP_LDFLAGS)
+---  misc/build/nss-3.13.5/mozilla/nsprpub/pr/include/md/_win95.cfg	2010-01-27 03:45:49.000000000 +0100
++++  misc/build/nss-3.13.5/mozilla/nsprpub/pr/include/md/_win95.cfg	2012-03-22 11:24:22.139097286 +0100
+@@ -106,7 +106,7 @@
+ #define PR_BYTES_PER_WORD_LOG2	2
+ #define PR_BYTES_PER_DWORD_LOG2	3
+ 
+-#elif defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)
++#elif defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_) || defined (_WIN64)
+ 
+ #define IS_LITTLE_ENDIAN 1
+ #undef  IS_BIG_ENDIAN
+---  misc/build/nss-3.13.5/mozilla/nsprpub/pr/include/md/_winnt.cfg	2010-01-27 03:45:49.000000000 +0100
++++  misc/build/nss-3.13.5/mozilla/nsprpub/pr/include/md/_winnt.cfg	2012-03-22 11:24:22.140097261 +0100
+@@ -100,7 +100,7 @@
+ #define PR_BYTES_PER_WORD_LOG2	2
+ #define PR_BYTES_PER_DWORD_LOG2	2
+ 
+-#elif defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_)
++#elif defined(_M_X64) || defined(_M_AMD64) || defined(_AMD64_) || defined (_WIN64)
+ 
+ #define IS_LITTLE_ENDIAN 1
+ #undef  IS_BIG_ENDIAN
+---  misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in	2011-09-22 17:21:06.000000000 +0200
++++  misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in	2012-03-22 11:24:22.140097261 +0100
+@@ -9,6 +9,9 @@
+ topsrcdir	= @top_srcdir@
+ srcdir		= @srcdir@
+ VPATH		= @srcdir@
++
++LIBRARY_NAME = nspr
++LIBRARY_VERSION = $(MOD_MAJOR_VERSION)
+ 
+ include $(MOD_DEPTH)/config/autoconf.mk
+ 
+@@ -200,9 +200,9 @@
+ 
+ ifeq ($(OS_ARCH),WINNT)
+ ifdef NS_USE_GCC
+-OS_LIBS		= -ladvapi32 -lwsock32 -lwinmm
++OS_LIBS		= -ladvapi32 -lws2_32 -lmswsock -lwinmm
+ else
+-OS_LIBS		= advapi32.lib wsock32.lib winmm.lib
++OS_LIBS		= advapi32.lib ws2_32.lib mswsock.lib winmm.lib
+ endif
+ endif
+ 
+@@ -291,8 +291,6 @@
+ include $(srcdir)/bthreads/objs.mk
+ endif
+ 
+-LIBRARY_NAME = nspr
+-LIBRARY_VERSION = $(MOD_MAJOR_VERSION)
+ 
+ RELEASE_LIBS = $(TARGETS)
+ 
+---  misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/md/windows/ntgc.c	2010-11-30 00:26:19.000000000 +0100
++++  misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/md/windows/ntgc.c	2012-03-22 11:24:22.140097261 +0100
+@@ -44,7 +44,7 @@
+ 
+ PRWord *_MD_HomeGCRegisters(PRThread *t, int isCurrent, int *np) 
+ {
+-#if defined(_X86_)
++#if defined(_X86_) && (!defined(_AMD64_))
+     CONTEXT context;
+     context.ContextFlags = CONTEXT_INTEGER;
+ 
+---  misc/build/nss-3.13.5/mozilla/nsprpub/tools/Makefile.in	2008-05-04 00:28:44.000000000 +0200
++++  misc/build/nss-3.13.5/mozilla/nsprpub/tools/Makefile.in	2012-03-22 11:24:22.140097261 +0100
+@@ -219,7 +219,7 @@
+ 	echo winsock.lib     >>w16link
+ 	wlink @w16link.
+ else
+-	link $(LDOPTS) $< $(LIBPR) $(LIBPLC) wsock32.lib -out:$@
++	link $(LDOPTS) $< $(LIBPR) $(LIBPLC) ws2_32.lib mswsock.lib -out:$@
+ endif
+ else
+ ifeq ($(OS_ARCH),OS2)
diff --git a/external/nss/nss-3.13.3-build.patch.3 b/external/nss/nss-3.13.3-build.patch.3
new file mode 100644
index 000000000000..ee4ff042cf29
--- /dev/null
+++ b/external/nss/nss-3.13.3-build.patch.3
@@ -0,0 +1,259 @@
+---  misc/build/nss-3.13.5/mozilla/security/coreconf/rules.mk	2013-06-14 13:31:28.569204870 +0100
++++  misc/build/nss-3.13.5/mozilla/security/coreconf/rules.mk	2013-06-14 13:31:59.277567709 +0100
+@@ -400,7 +400,7 @@
+ PWD := $(shell pwd)
+ ifeq (,$(findstring ;,$(PATH)))
+ ifndef USE_MSYS
+-PWD := $(subst \,/,$(shell cygpath -w $(PWD)))
++#PWD := $(subst \,/,$(shell cygpath -w $(PWD)))
+ endif
+ endif
+ 
+---  misc/build/nss-3.13.5/mozilla/security/coreconf/WIN32.mk	2013-06-14 13:31:28.557204728 +0100
++++  misc/build/nss-3.13.5/mozilla/security/coreconf/WIN32.mk	2013-06-14 13:31:59.278567724 +0100
+@@ -124,7 +124,7 @@
+     # The -mnop-fun-dllimport flag allows us to avoid a drawback of
+     # the dllimport attribute that a pointer to a function marked as
+     # dllimport cannot be used as as a constant address.
+-    OS_CFLAGS += -mwindows -mms-bitfields -mnop-fun-dllimport
++    OS_CFLAGS += -mwindows -mms-bitfields -mnop-fun-dllimport -D_WIN32_IE=0x0501 -U__MMX__ -U__SSE__ -U__SSE2__
+     _GEN_IMPORT_LIB=-Wl,--out-implib,$(IMPORT_LIBRARY)
+     DLLFLAGS  += -mwindows -o $@ -shared -Wl,--export-all-symbols $(if $(IMPORT_LIBRARY),$(_GEN_IMPORT_LIB))
+     ifdef BUILD_OPT
+---  misc/build/nss-3.13.5/mozilla/security/coreconf/WINNT.mk	2013-06-14 13:31:28.560204763 +0100
++++  misc/build/nss-3.13.5/mozilla/security/coreconf/WINNT.mk	2013-06-14 13:31:59.278567724 +0100
+@@ -46,7 +46,7 @@
+ #
+ # Win NT needs -GT so that fibers can work
+ #
+-OS_CFLAGS += -GT
++#OS_CFLAGS += -GT
+ 
+ # WINNT uses the lib prefix, Win95 and WinCE don't
+ NSPR31_LIB_PREFIX = lib
+---  misc/build/nss-3.13.5/mozilla/security/nss/cmd/crmftest/Makefile	2013-06-14 13:31:28.678206158 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/cmd/crmftest/Makefile	2013-06-14 13:31:59.278567724 +0100
+@@ -90,7 +90,7 @@
+ LDDIST = $(DIST)/lib
+ 
+ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+-EXTRA_LIBS += $(LDDIST)/sectool.lib
++#EXTRA_LIBS += $(LDDIST)/sectool.lib
+ endif
+ 
+ include ../platrules.mk
+---  misc/build/nss-3.13.5/mozilla/security/nss/cmd/pk11mode/Makefile	2013-06-14 13:31:28.709206524 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/cmd/pk11mode/Makefile	2013-06-14 13:31:59.279567738 +0100
+@@ -61,9 +61,9 @@
+ ifeq ($(OS_ARCH), WINNT)
+ 
+ EXTRA_LIBS += \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(IMPORT_LIB_SUFFIX) \
+ 	$(NULL)
+ 
+ else
+---  misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2013-06-14 13:31:28.680206181 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2013-06-14 13:31:59.279567738 +0100
+@@ -59,9 +59,9 @@
+ ifeq ($(OS_ARCH), WINNT)
+ 
+ EXTRA_LIBS += \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(IMPORT_LIB_SUFFIX) \
+ 	$(NULL)
+ 
+ else
+@@ -93,8 +93,8 @@
+ endif
+ CHECKLOC = $(CHECKLIBS:.$(DLL_SUFFIX)=.chk)
+ 
+-MD_LIB_RELEASE_FILES = $(CHECKLOC)
+-ALL_TRASH += $(CHECKLOC)
++MD_LIB_RELEASE_FILES = # $(CHECKLOC)
++#ALL_TRASH += $(CHECKLOC)
+ 
+ 
+ #######################################################################
+@@ -128,5 +128,5 @@
+ 	$(call core_abspath,$(NSPR_LIB_DIR)) $(call core_abspath,$<)
+ endif
+ 
+-libs install :: $(CHECKLOC)
++libs install :: #$(CHECKLOC)
+ 
+---  misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/mangle/Makefile	2013-06-14 13:31:28.681206193 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/mangle/Makefile	2013-06-14 13:31:59.279567738 +0100
+@@ -59,9 +59,9 @@
+ ifeq ($(OS_ARCH), WINNT)
+ 
+ EXTRA_LIBS += \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(LIB_SUFFIX) \
+-	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.$(IMPORT_LIB_SUFFIX) \
++	$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.$(IMPORT_LIB_SUFFIX) \
+ 	$(NULL)
+ 
+ else
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/ckfw/builtins/config.mk	2013-06-14 13:31:28.666206016 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/ckfw/builtins/config.mk	2013-06-14 13:31:59.280567750 +0100
+@@ -48,7 +48,7 @@
+ 
+ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+     SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-    RES = $(OBJDIR)/$(LIBRARY_NAME).res
++    RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+     RESNAME = $(LIBRARY_NAME).rc
+ endif
+ 
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/ckfw/capi/Makefile	2013-06-14 13:31:28.669206051 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/ckfw/capi/Makefile	2013-06-14 13:31:59.280567750 +0100
+@@ -75,6 +75,9 @@
+ 	-lplc4 \
+ 	-lplds4 \
+ 	-lnspr4 \
++        -lcrypt32 \
++        -ladvapi32 \
++        -lrpcrt4 \
+ 	$(NULL)
+ endif
+ 
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/config.mk	2013-06-14 13:31:28.593205153 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/config.mk	2013-06-14 13:31:59.280567750 +0100
+@@ -82,7 +82,7 @@
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ 
+-RES     = $(OBJDIR)/$(LIBRARY_NAME).res
++RES     = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = freebl.rc
+ 
+ ifndef WINCE
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/Makefile	2013-06-14 13:31:28.588205094 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/Makefile	2013-06-14 13:31:59.281567762 +0100
+@@ -171,6 +171,17 @@
+     endif
+ endif
+ else
++# 64-bit Windows
++ifdef NS_USE_GCC
++    # win64/gcc - use the x86 code for now, skipping optimization
++    ifdef BUILD_OPT
++	OPTIMIZER += -Os
++    endif
++    ASFILES  =
++    DEFINES += -DMPI_AMD64 -DMP_USE_UINT_DIGIT
++    DEFINES += -DMP_CHAR_STORE_SLOW -DMP_IS_LITTLE_ENDIAN
++else
++# MSVC
+     # -DMP_NO_MP_WORD
+     ifdef BUILD_OPT
+ 	OPTIMIZER += -Ox  # maximum optimization for freebl
+@@ -182,6 +193,7 @@
+     MPI_SRCS += mpi_amd64.c
+ endif
+ endif
++endif
+ 
+ ifeq ($(OS_TARGET),WINCE)
+     DEFINES += -DMP_ARGCHK=0	# no assert in WinCE
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/mpi/mpi-priv.h	2013-06-14 13:31:28.605205295 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/freebl/mpi/mpi-priv.h	2013-06-14 13:31:59.281567762 +0100
+@@ -254,7 +254,7 @@
+ #define MPI_ASM_DECL
+ #endif
+ 
+-#ifdef MPI_AMD64
++#if defined(MPI_AMD64) && defined(MP_ASSEMBLY_MULTIPLY)
+ 
+ mp_digit MPI_ASM_DECL s_mpv_mul_set_vec64(mp_digit*, mp_digit *, mp_size, mp_digit);
+ mp_digit MPI_ASM_DECL s_mpv_mul_add_vec64(mp_digit*, const mp_digit*, mp_size, mp_digit);
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk	2013-06-14 13:31:28.620205472 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk	2013-06-14 13:31:59.281567762 +0100
+@@ -42,7 +42,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/$(LIBRARY_NAME).res
++RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+ 
+ ifdef NS_USE_GCC
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk	2013-06-14 13:31:28.580205000 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk	2013-06-14 13:31:59.282567773 +0100
+@@ -43,7 +43,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/smime.res
++RES = $(OBJDIR)/smime.res.o
+ RESNAME = smime.rc
+ 
+ ifdef NS_USE_GCC
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk	2013-06-14 13:31:28.662205969 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk	2013-06-14 13:31:59.282567773 +0100
+@@ -49,7 +49,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/$(LIBRARY_NAME).res
++RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+ 
+ ifdef NS_USE_GCC
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk	2013-06-14 13:31:28.660205945 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk	2013-06-14 13:31:59.282567773 +0100
+@@ -50,7 +50,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/$(LIBRARY_NAME).res
++RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+ 
+ ifdef NS_USE_GCC
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk	2013-06-14 13:31:28.614205402 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk	2013-06-14 13:31:59.283567784 +0100
+@@ -55,7 +55,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/ssl.res
++RES = $(OBJDIR)/ssl.res.o
+ RESNAME = ssl.rc
+ 
+ ifdef NS_USE_GCC
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk	2013-06-14 13:31:28.674206110 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk	2013-06-14 13:31:59.283567784 +0100
+@@ -47,8 +47,8 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/$(LIBRARY_NAME).res
+-RESNAME = $(LIBRARY_NAME).rc
++#RES = $(OBJDIR)/$(LIBRARY_NAME).res
++#RESNAME = $(LIBRARY_NAME).rc
+ 
+ ifdef NS_USE_GCC
+ EXTRA_SHARED_LIBS += \
+---  misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk	2013-06-14 13:31:28.629205579 +0100
++++  misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk	2013-06-14 13:31:59.283567784 +0100
+@@ -42,7 +42,7 @@
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+ IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
+ 
+-RES = $(OBJDIR)/$(LIBRARY_NAME).res
++RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+ 
+ ifdef NS_USE_GCC
diff --git a/external/nss/nss-3.13.5-zlib-werror.patch b/external/nss/nss-3.13.5-zlib-werror.patch
new file mode 100644
index 000000000000..c3440c8ed99f
--- /dev/null
+++ b/external/nss/nss-3.13.5-zlib-werror.patch
@@ -0,0 +1,12 @@
+--- misc/nss-3.13.5/mozilla/security/nss/lib/zlib/gzguts.h	2010-08-22 03:07:03.000000000 +0200
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/zlib/gzguts.h	2012-07-17 08:52:14.821552788 +0200
+@@ -26,6 +26,9 @@
+ #  include <limits.h>
+ #endif
+ #include <fcntl.h>
++#ifndef _WIN32
++#include <unistd.h>
++#endif
+ 
+ #ifdef NO_DEFLATE       /* for compatibility with old definition */
+ #  define NO_GZCOMPRESS
diff --git a/external/nss/nss.aix.patch b/external/nss/nss.aix.patch
new file mode 100644
index 000000000000..a8a6a8eaf1ee
--- /dev/null
+++ b/external/nss/nss.aix.patch
@@ -0,0 +1,143 @@
+--- misc/nss-3.13.5/mozilla/nsprpub/configure	2010-08-18 07:23:01.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/nsprpub/configure	2010-08-18 07:33:11.000000000 -0500
+@@ -2973,7 +2973,8 @@
+ #define SYSV 1
+ EOF
+ 
+-    DSO_LDOPTS='-brtl -bnortllib -bM:SRE -bnoentry -bexpall -blibpath:/usr/lib:/lib'
++    MKSHLIB='$(CCC) -shared $(DSO_LDOPTS) -o $@'
++    DSO_LDOPTS='-Wl,-brtl -Wl,-bnortllib -Wl,-blibpath:/usr/lib:/lib'
+     ac_safe=`echo "sys/atomic_op.h" | sed 'y%./+-%__p_%'`
+ echo $ac_n "checking for sys/atomic_op.h""... $ac_c" 1>&6
+ echo "configure:3466: checking for sys/atomic_op.h" >&5
+@@ -3102,7 +3103,6 @@
+         AIX_LINK_OPTS='-brtl -bnso -berok'
+         ;;
+     esac
+-    CFLAGS="$CFLAGS -qro -qroconst"
+     AIX_WRAP='$(DIST)/lib/aixwrap.o'
+     AIX_TMP='./_aix_tmp.o'
+     if test -n "$USE_64"; then
+--- misc/nss-3.13.5/mozilla/nsprpub/configure.in	2010-08-18 07:23:01.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/nsprpub/configure.in	2010-08-18 07:32:36.000000000 -0500
+@@ -831,7 +831,8 @@
+     AC_DEFINE(XP_UNIX)
+     AC_DEFINE(AIX)
+     AC_DEFINE(SYSV)
+-    DSO_LDOPTS='-brtl -bnortllib -bM:SRE -bnoentry -bexpall -blibpath:/usr/lib:/lib'
++    DSO_LDOPTS='-Wl,-brtl -Wl,-bnortllib -Wl,-blibpath:/usr/lib:/lib'
++    MKSHLIB='$(CCC) -shared $(DSO_LDOPTS) -o $@'
+     AC_CHECK_HEADER(sys/atomic_op.h, AC_DEFINE(AIX_HAVE_ATOMIC_OP_H))
+     case "${target_os}" in
+     aix3.2*)
+@@ -871,10 +872,9 @@
+         AC_DEFINE(HAVE_SOCKLEN_T)
+         AC_DEFINE(HAVE_FCNTL_FILE_LOCKING)
+         USE_IPV6=1
+-        AIX_LINK_OPTS='-brtl -bnso -berok'
++        AIX_LINK_OPTS='-Wl,-brtl -Wl,-bnso -Wl,-berok'
+         ;;
+     esac
+-    CFLAGS="$CFLAGS -qro -qroconst"
+     AIX_WRAP='$(DIST)/lib/aixwrap.o'
+     AIX_TMP='./_aix_tmp.o'
+     if test -n "$USE_64"; then
+--- misc/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in	2010-08-18 07:23:04.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in	2010-08-18 07:24:49.000000000 -0500
+@@ -110,7 +110,6 @@
+ endif
+ 
+ ifeq ($(OS_ARCH),AIX)
+-DSO_LDOPTS	+= -binitfini::_PR_Fini
+ OS_LIBS		= -lodm -lcfg
+ ifeq ($(CLASSIC_NSPR),1)
+ ifeq ($(OS_RELEASE),4.1)
+--- misc/nss-3.13.5/mozilla/security/coreconf/AIX.mk	2010-08-18 07:23:06.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/AIX.mk	2010-08-18 07:26:26.000000000 -0500
+@@ -62,35 +62,30 @@
+ 
+ DEFAULT_COMPILER = xlc_r
+ 
+-CC		= xlc_r
+-CCC		= xlC_r
++CCC		= $(CXX)
+ 
+ CPU_ARCH	= rs6000
+ 
+ RANLIB		= ranlib
+ 
+ OS_CFLAGS	= -DAIX -DSYSV
+-OS_LIBS 	+= -blibpath:/usr/lib:/lib -lc -lm
++OS_LIBS 	+= -Wl,-blibpath:/usr/lib:/lib -lc -lm
+ 
+-DSO_LDOPTS	= -brtl -bnortllib -bM:SRE -bnoentry
+-MKSHLIB 	= $(LD) $(DSO_LDOPTS) -blibpath:/usr/lib:/lib -lc -lm
++DSO_LDOPTS	= -Wl,-brtl -Wl,-bnortllib
++MKSHLIB 	= $(CC) --shared $(DSO_LDOPTS) -Wl,-blibpath:/usr/lib:/lib -lc -lm
+ 
+ AIX_WRAP	= $(DIST)/lib/aixwrap.o
+ AIX_TMP		= $(OBJDIR)/_aix_tmp.o
+ 
+ ifdef MAPFILE
+-DSO_LDOPTS	+= -bexport:$(MAPFILE)
++DSO_LDOPTS	+= -Wl,-bexport:$(MAPFILE)
+ else
+-DSO_LDOPTS	+= -bexpall
++DSO_LDOPTS	+= -Wl,-bexpall
+ endif
+ 
+ PROCESS_MAP_FILE = grep -v ';+' $< | grep -v ';-' | \
+                 sed -e 's; DATA ;;' -e 's,;;,,' -e 's,;.*,,' > $@
+ 
+-ifdef BUILD_OPT
+-	OPTIMIZER += -qmaxmem=-1
+-endif
+-
+ ifeq ($(USE_64), 1)
+ 	OS_CFLAGS	+= -DAIX_64BIT
+ 	OBJECT_MODE=64
+--- misc/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk	2010-08-18 07:23:18.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk	2010-08-18 07:26:48.000000000 -0500
+@@ -173,7 +173,7 @@
+ 	$(NULL)
+ 
+ ifeq ($(OS_ARCH), AIX) 
+-EXTRA_SHARED_LIBS += -brtl 
++EXTRA_SHARED_LIBS += -Wl,-brtl 
+ endif
+ 
+ # $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
+@@ -223,7 +223,7 @@
+ 	$(NULL)
+ 
+ ifeq ($(OS_ARCH), AIX) 
+-EXTRA_SHARED_LIBS += -brtl 
++EXTRA_SHARED_LIBS += -Wl,-brtl 
+ endif
+ 
+ # $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
+--- misc/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/mangle/Makefile	2010-08-18 07:23:20.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/mangle/Makefile	2010-08-18 07:42:44.000000000 -0500
+@@ -75,7 +75,9 @@
+ 
+ endif
+ 
+-
++ifeq ($(OS), AIX)
++EXTRA_SHARED_LIBS += -lpthreads
++endif
+ 
+ #######################################################################
+ # (5) Execute "global" rules. (OPTIONAL)                              #
+--- misc/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2010-08-18 08:00:17.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2010-08-18 07:55:55.000000000 -0500
+@@ -75,6 +75,9 @@
+ 
+ endif
+ 
++ifeq ($(OS), AIX)
++EXTRA_SHARED_LIBS += -lpthreads
++endif
+ 
+ # sign any and all shared libraries that contain the word freebl
+ 
diff --git a/external/nss/nss.mingw.patch.3 b/external/nss/nss.mingw.patch.3
new file mode 100644
index 000000000000..db073e94919a
--- /dev/null
+++ b/external/nss/nss.mingw.patch.3
@@ -0,0 +1,128 @@
+diff -up misc/build/nss-3.13.5/mozilla/nsprpub/config/Makefile.in.dt nss/wntgcci.pro/misc/build/nss-3.13.5/mozilla/nsprpub/config/Makefile.in
+--- misc/build/nss-3.13.5/mozilla/nsprpub/config/Makefile.in.dt	2012-10-29 13:30:49.244696426 +0100
++++ misc/build/nss-3.13.5/mozilla/nsprpub/config/Makefile.in	2012-10-29 13:31:26.541830215 +0100
+@@ -30,7 +30,6 @@ CSRCS	= now.c
+ 
+ # This version hasn't been ported for us; the one in mozilla/config has
+ ifneq ($(OS_ARCH),OS2)
+-CSRCS  += nsinstall.c
+  
+ PLSRCS	= nfspwd.pl
+ endif
+@@ -84,7 +83,6 @@ else
+ ifeq (,$(filter-out SYMBIAN WINCE,$(OS_ARCH)))
+ TARGETS = $(PROGS)
+ else
+-PROGS	+= $(OBJDIR)/nsinstall$(PROG_SUFFIX)
+ TARGETS = $(PROGS) $(PLSRCS:.pl=)
+ endif
+ endif
+diff -up ./nss-3.13.5/mozilla/security/nss/Makefile.dt ./nss-3.13.5/mozilla/security/nss/Makefile
+--- misc/build/nss-3.13.5/mozilla/security/nss/Makefile.dt	2012-10-30 10:13:07.165713712 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/Makefile	2012-10-30 10:13:09.680656998 +0100
+@@ -58,7 +58,7 @@ include $(CORE_DEPTH)/coreconf/config.mk
+ # (4) Include "local" platform-dependent assignments (OPTIONAL).      #
+ #######################################################################
+ 
+-ifeq ($(OS_TARGET),WINCE)
++ifeq ($(OS_TARGET),WINNT)
+ DIRS	= lib	# omit cmd since wince has no command line shell
+ endif
+ 
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk.dt	2012-10-30 12:31:06.675726730 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/nss/config.mk	2012-10-30 12:31:08.860676053 +0100
+@@ -40,7 +40,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk.dt	2012-10-30 12:30:52.020062600 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/smime/config.mk	2012-10-30 12:30:54.504004586 +0100
+@@ -41,7 +41,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/smime.res.o
+ RESNAME = smime.rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk.dt	2012-10-30 12:31:02.707816790 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/config.mk	2012-10-30 12:31:04.388778631 +0100
+@@ -47,7 +47,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk.dt	2012-10-30 12:30:56.531958414 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/softoken/legacydb/config.mk	2012-10-30 12:31:00.575865594 +0100
+@@ -48,7 +48,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/sqlite/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/sqlite/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/sqlite/config.mk.dt	2012-10-30 12:31:10.499638736 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/sqlite/config.mk	2012-10-30 12:31:12.624590177 +0100
+@@ -41,7 +41,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ #RES = $(OBJDIR)/$(LIBRARY_NAME).res
+ #RESNAME = $(LIBRARY_NAME).rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk.dt	2012-10-30 12:31:14.882539495 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/ssl/config.mk	2012-10-30 12:31:16.379504032 +0100
+@@ -53,7 +53,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/ssl.res.o
+ RESNAME = ssl.rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk.dt	2012-10-30 12:31:18.195462428 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/sysinit/config.mk	2012-10-30 12:31:20.277414942 +0100
+@@ -45,7 +45,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ #RES = $(OBJDIR)/$(LIBRARY_NAME).res
+ #RESNAME = $(LIBRARY_NAME).rc
+diff -up misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk.dt misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk
+--- misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk.dt	2012-10-30 12:31:22.179371231 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/lib/util/config.mk	2012-10-30 12:31:24.074328169 +0100
+@@ -40,7 +40,7 @@ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+ 
+ # don't want the 32 in the shared library name
+ SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+-IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
++IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(IMPORT_LIB_SUFFIX)
+ 
+ RES = $(OBJDIR)/$(LIBRARY_NAME).res.o
+ RESNAME = $(LIBRARY_NAME).rc
diff --git a/external/nss/nss.patch b/external/nss/nss.patch
new file mode 100644
index 000000000000..e2d7d7653308
--- /dev/null
+++ b/external/nss/nss.patch
@@ -0,0 +1,242 @@
+--- misc/nss-3.13.5/mozilla/nsprpub/configure	2010-02-08 19:41:35.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/nsprpub/configure	2010-06-11 16:35:54.960188991 +0200
+@@ -3900,7 +3900,7 @@
+     PR_MD_CSRCS=linux.c
+     MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@'
+     DSO_CFLAGS=-fPIC
+-    DSO_LDOPTS='-shared -Wl,-soname -Wl,$(notdir $@)'
++    DSO_LDOPTS='-shared -Wl,-z,origin -Wl,-rpath,\$$ORIGIN -Wl,-soname -Wl,$(notdir $@)'
+     _OPTIMIZE_FLAGS=-O2
+     _DEBUG_FLAGS="-g -fno-inline"  # most people on linux use gcc/gdb, and that
+                                    # combo is not yet good at debugging inlined
+--- misc/nss-3.13.5/mozilla/security/coreconf/Darwin.mk	2010-02-04 19:59:10.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/Darwin.mk	2010-06-11 16:35:54.966185975 +0200
+@@ -39,8 +39,12 @@
+ 
+ DEFAULT_COMPILER = gcc
+ 
+-CC		= gcc
+-CCC		= g++
++# CC is taken from environment automatically.
++#CC		= cc
++# Use CCC from environment.
++#CCC		= c++
++CCC		= $(CXX)
++
+ RANLIB		= ranlib
+ 
+ ifndef CPU_ARCH
+@@ -57,19 +57,25 @@
+ 
+ ifeq (,$(filter-out i%86,$(CPU_ARCH)))
+ ifdef USE_64
++ifeq (,$(findstring -arch ,$(CC)))
+ CC              += -arch x86_64
++endif
+ override CPU_ARCH	= x86_64
+ else
+ OS_REL_CFLAGS	= -Di386
++ifeq (,$(findstring -arch ,$(CC)))
+ CC              += -arch i386
++endif
+ override CPU_ARCH	= x86
+ endif
+ else
+ ifeq (arm,$(CPU_ARCH))
+ # Nothing set for arm currently.
+ else
+ OS_REL_CFLAGS	= -Dppc
++ifeq (,$(findstring -arch ,$(CC)))
+ CC              += -arch ppc
++endif
+ endif
+ endif
+ 
+--- misc/nss-3.13.5/mozilla/security/coreconf/FreeBSD.mk	2009-11-23 05:06:29.000000000 -0500
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/FreeBSD.mk	2012-08-28 20:27:20.000000000 -0400
+@@ -57,6 +57,7 @@
+ 
+ DSO_CFLAGS		= -fPIC
+ DSO_LDOPTS		= -shared -Wl,-soname -Wl,$(notdir $@)
++DSO_LDOPTS		+= -Wl,-z,origin '-Wl,-rpath,$$ORIGIN'
+ 
+ #
+ # The default implementation strategy for FreeBSD is pthreads.
+--- misc/nss-3.13.5/mozilla/security/coreconf/Linux.mk	2010-01-15 23:19:00.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/Linux.mk	2010-06-11 16:35:54.981151732 +0200
+@@ -46,8 +46,11 @@
+ 	IMPL_STRATEGY = _PTH
+ endif
+ 
+-CC			= gcc
+-CCC			= g++
++# CC is taken from environment automatically.
++#CC			= gcc
++# Use CCC from environment.
++#CCC			= g++
++CCC		= $(CXX)
+ RANLIB			= ranlib
+ 
+ DEFAULT_COMPILER = gcc
+@@ -147,7 +150,7 @@
+ # incorrectly reports undefined references in the libraries we link with, so
+ # we don't use -z defs there.
+ ZDEFS_FLAG		= -Wl,-z,defs
+-DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG))
++DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) -Wl,-z,origin '-Wl,-rpath,$$ORIGIN'
+ LDFLAGS			+= $(ARCHFLAG)
+ 
+ # On Maemo, we need to use the -rpath-link flag for even the standard system
+@@ -158,8 +161,13 @@
+ endif
+ endif
+ 
++ifeq ($(SYSTEM_ZLIB),YES)  
++# Currently (3.12.4) only the tools modutil and signtool are linked with libz
++# If USE_SYSTEM_ZLIB is not set then the tools link statically libzlib.a which
++# is also build in nss.
+ USE_SYSTEM_ZLIB = 1
+ ZLIB_LIBS = -lz
++endif
+ 
+ # The -rpath '$$ORIGIN' linker option instructs this library to search for its
+ # dependencies in the same directory where it resides.
+--- misc/nss-3.13.5/mozilla/security/coreconf/SunOS5.mk	2009-06-11 02:55:32.000000000 +0200
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/SunOS5.mk	2010-06-11 16:35:54.985571182 +0200
+@@ -89,8 +89,12 @@
+ 	    # OPTIMIZER += -mno-omit-leaf-frame-pointer -fno-omit-frame-pointer
+ 	endif
+ else
+-	CC         = cc
+-	CCC        = CC
++# CC is taken from environment automatically.
++#	CC         = cc
++# Use CXX from environment.
++#	CCC        = CC
++        CCC       = $(CXX)
++
+ 	ASFLAGS   += -Wa,-P
+ 	OS_CFLAGS += $(NOMD_OS_CFLAGS) $(ARCHFLAG)
+ 	ifndef BUILD_OPT
+--- misc/nss-3.13.5/mozilla/security/coreconf/arch.mk	2009-06-05 04:14:49.000000000 +0200
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/arch.mk	2010-06-11 16:35:54.990913282 +0200
+@@ -324,10 +324,15 @@
+ # IMPL_STRATEGY may be defined too.
+ #
+ 
+-OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++# OBJDIR_NAME is used to build the directory containing the built objects, for 
++# example mozilla/dist/Linux2.6_x86_glibc_PTH_DBG.OBJ
++# We need to deliver the contents of that folder into the solver. To make that easier
++# in the makefile we rename this directory to "out". 
++#OBJDIR_NAME = $(OS_TARGET)$(OS_RELEASE)$(CPU_TAG)$(COMPILER_TAG)$(LIBC_TAG)$(IMPL_STRATEGY)$(OBJDIR_TAG).OBJ
++OBJDIR_NAME = out
+ 
+ ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+-ifndef BUILD_OPT
++ifdef THIS_HAS_BEEN_DISABLED_TO_GET_out
+ #
+ # Define USE_DEBUG_RTL if you want to use the debug runtime library
+ # (RTL) in the debug build
+--- misc/nss-3.13.5/mozilla/security/coreconf/rules.mk
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/rules.mk
+@@ -293,7 +293,7 @@
+ ifeq (,$(filter-out _WIN%,$(NS_USE_GCC)_$(OS_TARGET)))
+ 	$(AR) $(subst /,\\,$(OBJS))
+ else
+-	$(AR) $(OBJS)
++	$(AR) cr $@ $(OBJS)
+ endif
+ 	$(RANLIB) $@
+ 
+--- misc/nss-3.13.5/mozilla/security/nss/Makefile
++++ misc/build/nss-3.13.5/mozilla/security/nss/Makefile
+@@ 1,0 +1,0 @@
++export AR
++export RANLIB
+ #! gmake
+ #
+ # ***** BEGIN LICENSE BLOCK *****
+--- misc/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk	2010-02-04 19:59:10.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/cmd/platlibs.mk	2010-06-11 16:35:55.004869805 +0200
+@@ -41,27 +41,32 @@
+ ifeq ($(OS_ARCH), SunOS) 
+ ifeq ($(BUILD_SUN_PKG), 1)
+ ifeq ($(USE_64), 1)
+-EXTRA_SHARED_LIBS += -R '$$ORIGIN/../lib:/usr/lib/mps/secv1/64:/usr/lib/mps/64'
++#In OOo we would probable put the executables next to libs
++EXTRA_SHARED_LIBS += -R '$$ORIGIN'
+ else
+-EXTRA_SHARED_LIBS += -R '$$ORIGIN/../lib:/usr/lib/mps/secv1:/usr/lib/mps'
++EXTRA_SHARED_LIBS += -R '$$ORIGIN'
+ endif
+ else
+-EXTRA_SHARED_LIBS += -R '$$ORIGIN/../lib'
++EXTRA_SHARED_LIBS += -R '$$ORIGIN'
+ endif
+ endif
+ 
++ifeq ($(OS_ARCH), FreeBSD)
++EXTRA_SHARED_LIBS += -Wl,-z,origin -Wl,-rpath,'$$ORIGIN'
++endif
++
+ ifeq ($(OS_ARCH), Linux)
+ ifeq ($(BUILD_SUN_PKG), 1)
+ ifeq ($(USE_64), 1)
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:/opt/sun/private/lib64:$$ORIGIN/../lib'
++EXTRA_SHARED_LIBS += -Wl,-z,origin -Wl,-rpath,'$$ORIGIN'
+ else
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib:/opt/sun/private/lib'
++EXTRA_SHARED_LIBS += -Wl,-z,origin -Wl,-rpath,'$$ORIGIN'
+ endif
+ else
+ ifeq ($(USE_64), 1)
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib64:$$ORIGIN/../lib'
++EXTRA_SHARED_LIBS += -Wl,-z,origin -Wl,-rpath,'$$ORIGIN'
+ else
+-EXTRA_SHARED_LIBS += -Wl,-rpath,'$$ORIGIN/../lib'
++EXTRA_SHARED_LIBS += -Wl,-z,origin -Wl,-rpath,'$$ORIGIN'
+ endif
+ endif
+ endif
+--- misc/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2009-08-07 21:06:37.000000000 +0200
++++ misc/build/nss-3.13.5/mozilla/security/nss/cmd/shlibsign/Makefile	2010-06-11 16:35:55.009851148 +0200
+@@ -78,10 +78,15 @@
+ 
+ # sign any and all shared libraries that contain the word freebl
+ 
+-CHECKLIBS = $(DIST)/lib/$(DLL_PREFIX)softokn3.$(DLL_SUFFIX)
+-CHECKLIBS += $(wildcard $(DIST)/lib/$(DLL_PREFIX)freebl*3.$(DLL_SUFFIX))
++# Signing causes loading of some system library which in turn loads
++# libsqlite3. Then it loads libsqulite3 from nss, which does not have the proper
++# version. Therefore signing fails.
++# We cannot build with the system sqlite3, because it is too old (SDK
++# 10.4). Otherwise one could set NSS_USE_SYSTEM_SQLITE=1 and use the system lib. 
++#CHECKLIBS = $(DIST)/lib/$(DLL_PREFIX)softokn3.$(DLL_SUFFIX)
++#CHECKLIBS += $(wildcard $(DIST)/lib/$(DLL_PREFIX)freebl*3.$(DLL_SUFFIX))
+ ifndef NSS_DISABLE_DBM
+-CHECKLIBS += $(DIST)/lib/$(DLL_PREFIX)nssdbm3.$(DLL_SUFFIX)
++#CHECKLIBS += $(DIST)/lib/$(DLL_PREFIX)nssdbm3.$(DLL_SUFFIX)
+ endif
+ CHECKLOC = $(CHECKLIBS:.$(DLL_SUFFIX)=.chk)
+ 
+--- misc/nss-3.13.5/mozilla/security/coreconf/Darwin.mk
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/Darwin.mk
+@@ -64,12 +64,16 @@
+ endif
+ 
+ ifneq (,$(MACOS_SDK_DIR))
++    CLANG_VERSION_FULL := $(shell $(CC) -v 2>&1 | grep "clang version" | sed -e "s/^.*clang version[  ]*//" | awk '{ print $$1 }')
+     GCC_VERSION_FULL := $(shell $(CC) -dumpversion)
+     GCC_VERSION_MAJOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$1 }')
+     GCC_VERSION_MINOR := $(shell echo $(GCC_VERSION_FULL) | awk -F. '{ print $$2 }')
+     GCC_VERSION = $(GCC_VERSION_MAJOR).$(GCC_VERSION_MINOR)
++    ifneq (,$(CLANG_VERSION_FULL))
++        DARWIN_SDK_CFLAGS = -isysroot $(MACOS_SDK_DIR)
++        DARWIN_SDK_SHLIBFLAGS = -isysroot $(MACOS_SDK_DIR)
+ 
+-    ifeq (,$(filter-out 2 3,$(GCC_VERSION_MAJOR)))
++    else ifeq (,$(filter-out 2 3,$(GCC_VERSION_MAJOR)))
+         # GCC <= 3
+         DARWIN_SDK_FRAMEWORKS = -F$(MACOS_SDK_DIR)/System/Library/Frameworks
+         ifneq (,$(shell find $(MACOS_SDK_DIR)/Library/Frameworks -maxdepth 0))
diff --git a/external/nss/nss.wheader-guard.patch.0 b/external/nss/nss.wheader-guard.patch.0
new file mode 100644
index 000000000000..a5d4060392ce
--- /dev/null
+++ b/external/nss/nss.wheader-guard.patch.0
@@ -0,0 +1,11 @@
+--- mozilla/security/nss/lib/pk11wrap/secmod.h
++++ mozilla/security/nss/lib/pk11wrap/secmod.h
+@@ -34,7 +34,7 @@
+  *
+  * ***** END LICENSE BLOCK ***** */
+ #ifndef _SECMOD_H_
+-#define _SEDMOD_H_
++#define _SECMOD_H_
+ #include "seccomon.h"
+ #include "secmodt.h"
+ #include "prinrval.h"
diff --git a/external/nss/nss.windows.patch b/external/nss/nss.windows.patch
new file mode 100644
index 000000000000..0d4ce1b5baea
--- /dev/null
+++ b/external/nss/nss.windows.patch
@@ -0,0 +1,22 @@
+--- misc/nss-3.13.5/mozilla/nsprpub/config/rules.mk	2008-12-03 00:24:39.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/nsprpub/config/rules.mk	2009-11-27 13:36:22.662753328 +0100
+@@ -415,7 +415,7 @@
+ 
+ ifdef NEED_ABSOLUTE_PATH
+ # The quotes allow absolute paths to contain spaces.
+-pr_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(CURDIR)/$(1)))"
++pr_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(shell cygpath -m $(1))),$(1),$(shell cygpath -m $(CURDIR)/$(1))))"
+ endif
+ 
+ $(OBJDIR)/%.$(OBJ_SUFFIX): %.cpp
+--- misc/nss-3.13.5/mozilla/security/coreconf/rules.mk	2008-12-03 00:24:39.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/rules.mk	2009-11-27 13:36:22.662753328 +0100
+@@ -411,7 +411,7 @@
+ endif
+ 
+ # The quotes allow absolute paths to contain spaces.
+-core_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(1)),$(1),$(PWD)/$(1)))"
++core_abspath = "$(if $(findstring :,$(1)),$(1),$(if $(filter /%,$(shell cygpath -m $(1))),$(1),$(shell cygpath -m $(PWD)/$(1))))"
+ 
+ $(OBJDIR)/$(PROG_PREFIX)%$(OBJ_SUFFIX): %.c
+ 	@$(MAKE_OBJDIR)
diff --git a/external/nss/nss_macosx.patch b/external/nss/nss_macosx.patch
new file mode 100644
index 000000000000..102e9a322fdc
--- /dev/null
+++ b/external/nss/nss_macosx.patch
@@ -0,0 +1,78 @@
+--- misc/nss-3.13.5/mozilla/security/nss/Makefile	2008-12-03 00:24:39.000000000 +0100
++++ misc/build/nss-3.13.5/mozilla/security/nss/Makefile	2009-11-27 13:36:22.662753328 +0100
+@@ -104,6 +104,9 @@
+ ifeq ($(OS_TARGET),WIN95)
+ NSPR_CONFIGURE_OPTS += --enable-win32-target=WIN95
+ endif
++ifdef MACOS_SDK_DIR
++NSPR_CONFIGURE_OPTS += --with-macos-sdk=$(MACOS_SDK_DIR)
++endif
+ ifdef USE_DEBUG_RTL
+ NSPR_CONFIGURE_OPTS += --enable-debug-rtl
+ endif
+--- misc/nss-3.13.5/mozilla/nsprpub/configure
++++ misc/build/nss-3.13.5/mozilla/nsprpub/configure
+@@ -3888,7 +3889,7 @@
+ fi
+ 
+     DSO_CFLAGS=-fPIC
+-    DSO_LDOPTS='-dynamiclib -compatibility_version 1 -current_version 1 -all_load -install_name @executable_path/$@ -headerpad_max_install_names'
++    DSO_LDOPTS='-dynamiclib -compatibility_version 1 -current_version 1 -all_load -install_name @__________________________________________________OOO/$@ -headerpad_max_install_names'
+     _OPTIMIZE_FLAGS=-O2
+     MKSHLIB='$(CC) $(DSO_LDOPTS) -o $@'
+     STRIP="$STRIP -x -S"
+--- misc/nss-3.13.5/mozilla/nsprpub/lib/ds/Makefile.in
++++ misc/build/nss-3.13.5/mozilla/nsprpub/lib/ds/Makefile.in
+@@ -143,7 +143,7 @@
+ 
+ export:: $(TARGETS)
+ 	$(INSTALL) -m 444 $(HEADERS) $(dist_includedir)
+-	$(INSTALL) -m 444 $(TARGETS) $(dist_libdir)
++	$(INSTALL) -m 664 $(TARGETS) $(dist_libdir)
+ ifdef SHARED_LIBRARY
+ ifeq ($(OS_ARCH),HP-UX)
+ 	$(INSTALL) -m 755 $(SHARED_LIBRARY) $(dist_libdir)
+--- misc/nss-3.13.5/mozilla/nsprpub/lib/libc/src/Makefile.in
++++ misc/build/nss-3.13.5/mozilla/nsprpub/lib/libc/src/Makefile.in
+@@ -144,7 +144,7 @@
+ #
+ 
+ export:: $(TARGETS)
+-	$(INSTALL) -m 444 $(TARGETS) $(dist_libdir)
++	$(INSTALL) -m 664 $(TARGETS) $(dist_libdir)
+ ifdef SHARED_LIBRARY
+ ifeq ($(OS_ARCH),HP-UX)
+ 	$(INSTALL) -m 755 $(SHARED_LIBRARY) $(dist_libdir)
+--- misc/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in
++++ misc/build/nss-3.13.5/mozilla/nsprpub/pr/src/Makefile.in
+@@ -365,7 +365,7 @@
+ #
+ 
+ build:: $(TARGETS)
+-	$(INSTALL) -m 444 $(TARGETS) $(dist_libdir)
++	$(INSTALL) -m 664 $(TARGETS) $(dist_libdir)
+ ifdef SHARED_LIBRARY
+ ifeq ($(OS_ARCH),HP-UX)
+ 	$(INSTALL) -m 755 $(SHARED_LIBRARY) $(dist_libdir)
+--- misc/nss-3.13.5/mozilla/security/coreconf/Darwin.mk
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/Darwin.mk
+@@ -150,7 +150,7 @@
+ # May override this with different compatibility and current version numbers.
+ DARWIN_DYLIB_VERSIONS = -compatibility_version 1 -current_version 1
+ # May override this with -bundle to create a loadable module.
+-DSO_LDOPTS	= -dynamiclib $(DARWIN_DYLIB_VERSIONS) -install_name @executable_path/$(notdir $@) -headerpad_max_install_names
++DSO_LDOPTS	= -dynamiclib $(DARWIN_DYLIB_VERSIONS) -install_name @__________________________________________________OOO/$(notdir $@) -headerpad_max_install_names
+ 
+ MKSHLIB		= $(CC) $(DSO_LDOPTS) $(DARWIN_SDK_SHLIBFLAGS)
+ DLL_SUFFIX	= dylib
+--- misc/nss-3.13.5/mozilla/security/coreconf/rules.mk
++++ misc/build/nss-3.13.5/mozilla/security/coreconf/rules.mk
+@@ -342,7 +342,7 @@
+ 	chmod +x $@
+ ifeq ($(OS_TARGET),Darwin)
+ ifdef MAPFILE
+-	nmedit -s $(MAPFILE) $@
++	$(NMEDIT) -s $(MAPFILE) $@
+ endif
+ endif
+ endif