Compare versions with the semver crate

neqo-crypto/Cargo.toml

@@ -21,6 +21,7 @@ neqo-common = { path = "../neqo-common" }
 # Sync with https://searchfox.org/mozilla-central/source/Cargo.lock 2024-02-08
 bindgen = { version = "0.69", default-features = false, features = ["runtime"] }
 mozbuild = { version = "0.1", default-features = false, optional = true }
+semver = { version = "1.0", default-features = false }
 serde = { version = "1.0", default-features = false }
 serde_derive = { version = "1.0", default-features = false }
 toml = { version = "0.5", default-features = false }

neqo-crypto/build.rs

@@ -12,8 +12,11 @@ use std::{
 };
 
 use bindgen::Builder;
+use semver::{Version, VersionReq};
 use serde_derive::Deserialize;
 
+include!("min_version.rs");
+
 const BINDINGS_DIR: &str = "bindings";
 const BINDINGS_CONFIG: &str = "bindings.toml";
 
@@ -301,23 +304,22 @@ fn pkg_config() -> Vec<String> {
         .output()
         .expect("pkg-config reports NSS as absent")
         .stdout;
-    let modversion_str = String::from_utf8(modversion).expect("non-UTF8 from pkg-config");
-    let mut v = modversion_str.split('.');
-    assert_eq!(
-        v.next(),
-        Some("3"),
-        "NSS version 3.62 or higher is needed, found {modversion_str} (or set $NSS_DIR)"
+    let modversion = String::from_utf8(modversion).expect("non-UTF8 from pkg-config");
+    let modversion = modversion.trim().to_string();
+    // The NSS version number does not follow semver numbering, because it omits the patch version
+    // when that's 0. Deal with that.
+    let modversion_for_cmp = if modversion.split('.').count() == 2 {
+        modversion.clone() + ".0"
+    } else {
+        modversion.clone()
+    };
+    let modversion_for_cmp =
+        Version::parse(&modversion_for_cmp).expect("NSS version not in semver format");
+    let version_req = VersionReq::parse(&(">=".to_owned() + MINIMUM_NSS_VERSION.trim())).unwrap();
+    assert!(
+        version_req.matches(&modversion_for_cmp),
+        "neqo has NSS version requirement {version_req}, found {modversion}"
     );
-    if let Some(minor) = v.next() {
-        let minor = minor
-            .trim_end()
-            .parse::<u32>()
-            .expect("NSS minor version is not a number");
-        assert!(
-            minor >= 62,
-            "NSS version 3.62 or higher is needed, found {modversion_str} (or set $NSS_DIR)",
-        );
-    }
 
     let cfg = Command::new("pkg-config")
         .args(["--cflags", "--libs", "nss"])

neqo-crypto/min_version.rs

@@ -0,0 +1,9 @@
+// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
+// option. This file may not be copied, modified, or distributed
+// except according to those terms.
+
+/// The minimum version of NSS that is required by this version of neqo.
+/// Note that the string may contain whitespace at the beginning and/or end.
+const MINIMUM_NSS_VERSION: &str = include_str!("min_version.txt");

neqo-crypto/min_version.txt

@@ -0,0 +1 @@
+3.98

neqo-crypto/src/lib.rs

@@ -59,7 +59,7 @@ pub use self::{
     ssl::Opt,
 };
 
-const MINIMUM_NSS_VERSION: &str = "3.97";
+include!("../min_version.rs");
 
 #[allow(non_upper_case_globals, clippy::redundant_static_lifetimes)]
 #[allow(clippy::upper_case_acronyms)]