Index: mozilla/configure.in
===================================================================
RCS file: /cvsroot/mozilla/configure.in,v
retrieving revision 1.1571
diff -u -r1.1571 configure.in
--- mozilla/configure.in	16 Dec 2005 20:55:43 -0000	1.1571
+++ mozilla/configure.in	20 Dec 2005 09:31:22 -0000
@@ -86,6 +86,7 @@
 MOZPNG=10207
 MOZZLIB=1.2.3
 NSPR_VERSION=4
+NSS_VERSION=3
 
 dnl Set the minimum version of toolkit libs used by mozilla
 dnl ========================================================
@@ -3558,6 +3559,42 @@
     fi
 fi
 
+dnl ========================================================
+dnl = If NSS was not detected in the system, 
+dnl = use the one in the source tree (mozilla/security/nss)
+dnl ========================================================
+
+MOZ_ARG_WITH_BOOL(system-nss,
+[  --with-system-nss      Use system installed NSS],
+    _USE_SYSTEM_NSS=1 )
+
+if test -n "$_USE_SYSTEM_NSS"; then
+    AM_PATH_NSS(3.0.0, [MOZ_NATIVE_NSS=1], [MOZ_NATIVE_NSS=])
+fi
+
+if test -n "$MOZ_NATIVE_NSS"; then
+   NSS_LIBS="$NSS_LIBS -lcrmf"
+else
+   NSS_CFLAGS='-I$(DIST)/public/nss'
+   NSS_DEP_LIBS='\\\
+        $(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)smime'$NSS_VERSION'$(DLL_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)ssl'$NSS_VERSION'$(DLL_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)nss'$NSS_VERSION'$(DLL_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)softokn'$NSS_VERSION'$(DLL_SUFFIX)'
+
+   if test -z "$GNU_CC" && test "$OS_ARCH" = "WINNT" -o "$OS_ARCH" = "WINCE" -o "$OS_ARCH" = "OS2"; then
+       NSS_LIBS='\\\
+        $(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)smime'$NSS_VERSION'$(IMPORT_LIB_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)ssl'$NSS_VERSION'$(IMPORT_LIB_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)nss'$NSS_VERSION'$(IMPORT_LIB_SUFFIX) \\\
+        $(DIST)/lib/$(DLL_PREFIX)softokn'$NSS_VERSION'$(IMPORT_LIB_SUFFIX)'
+   else
+       NSS_LIBS='-L$(LIBS_DIR)'" -lcrmf -lsmime$NSS_VERSION -lssl$NSS_VERSION -lnss$NSS_VERSION -lsoftokn$NSS_VERSION"
+   fi
+fi
+
 if test -z "$SKIP_LIBRARY_CHECKS"; then
 dnl system JPEG support
 dnl ========================================================
@@ -7002,6 +7039,11 @@
 AC_SUBST(NSPR_LIBS)
 AC_SUBST(MOZ_NATIVE_NSPR)
 
+AC_SUBST(NSS_CFLAGS)
+AC_SUBST(NSS_LIBS)
+AC_SUBST(NSS_DEP_LIBS)
+AC_SUBST(MOZ_NATIVE_NSS)
+
 AC_SUBST(CFLAGS)
 AC_SUBST(CXXFLAGS)
 AC_SUBST(CPPFLAGS)
Index: mozilla/aclocal.m4
===================================================================
RCS file: /cvsroot/mozilla/aclocal.m4,v
retrieving revision 1.14
diff -u -r1.14 aclocal.m4
--- mozilla/aclocal.m4	13 May 2004 03:12:47 -0000	1.14
+++ mozilla/aclocal.m4	20 Dec 2005 09:31:35 -0000
@@ -8,6 +8,7 @@
 builtin(include, build/autoconf/libIDL.m4)dnl
 builtin(include, build/autoconf/libIDL-2.m4)dnl
 builtin(include, build/autoconf/nspr.m4)dnl
+builtin(include, build/autoconf/nss.m4)dnl
 builtin(include, build/autoconf/libart.m4)dnl
 builtin(include, build/autoconf/pkg.m4)dnl
 builtin(include, build/autoconf/freetype2.m4)dnl
Index: mozilla/config/autoconf.mk.in
===================================================================
RCS file: /cvsroot/mozilla/config/autoconf.mk.in,v
retrieving revision 3.379
diff -u -r3.379 autoconf.mk.in
--- mozilla/config/autoconf.mk.in	16 Dec 2005 20:55:43 -0000	3.379
+++ mozilla/config/autoconf.mk.in	20 Dec 2005 09:31:36 -0000
@@ -236,6 +236,7 @@
 MOZ_INSURE_EXCLUDE_DIRS = @MOZ_INSURE_EXCLUDE_DIRS@
 
 MOZ_NATIVE_NSPR = @MOZ_NATIVE_NSPR@
+MOZ_NATIVE_NSS = @MOZ_NATIVE_NSS@
 
 CROSS_COMPILE   = @CROSS_COMPILE@
 
@@ -391,6 +392,11 @@
 NSPR_CFLAGS	= @NSPR_CFLAGS@
 NSPR_LIBS	= @NSPR_LIBS@
 
+NSS_CONFIG	= @NSS_CONFIG@
+NSS_CFLAGS	= @NSS_CFLAGS@
+NSS_LIBS	= @NSS_LIBS@
+NSS_DEP_LIBS	= @NSS_DEP_LIBS@
+
 LDAP_CFLAGS	= @LDAP_CFLAGS@
 LDAP_LIBS	= @LDAP_LIBS@
 XPCOM_GLUE_LDOPTS = @XPCOM_GLUE_LDOPTS@
Index: mozilla/config/config.mk
===================================================================
RCS file: /cvsroot/mozilla/config/config.mk,v
retrieving revision 3.344
diff -u -r3.344 config.mk
--- mozilla/config/config.mk	18 Dec 2005 17:09:20 -0000	3.344
+++ mozilla/config/config.mk	20 Dec 2005 09:31:36 -0000
@@ -136,39 +136,6 @@
 FINAL_LINK_COMPS = $(DEPTH)/config/final-link-comps
 FINAL_LINK_COMP_NAMES = $(DEPTH)/config/final-link-comp-names
 
-# 
-# NSS libs needed for final link in static build
-# 
-
-NSS_LIBS	= \
-	$(LIBS_DIR) \
-	$(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \
-	-lsmime3 \
-	-lssl3 \
-	-lnss3 \
-	-lsoftokn3 \
-	$(NULL)
-
-ifneq (,$(filter OS2 WINNT WINCE, $(OS_ARCH)))
-ifndef GNU_CC
-NSS_LIBS	= \
-	$(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)smime3.$(IMPORT_LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)ssl3.$(IMPORT_LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)nss3.$(IMPORT_LIB_SUFFIX) \
-	$(DIST)/lib/$(LIB_PREFIX)softokn3.$(IMPORT_LIB_SUFFIX) \
-	$(NULL)
-endif
-endif
-
-NSS_DEP_LIBS	= \
-	$(DIST)/lib/$(LIB_PREFIX)crmf.$(LIB_SUFFIX) \
-	$(DIST)/lib/$(DLL_PREFIX)smime3$(DLL_SUFFIX) \
-	$(DIST)/lib/$(DLL_PREFIX)ssl3$(DLL_SUFFIX) \
-	$(DIST)/lib/$(DLL_PREFIX)nss3$(DLL_SUFFIX) \
-	$(DIST)/lib/$(DLL_PREFIX)softokn3$(DLL_SUFFIX) \
-	$(NULL)
-
 MOZ_UNICHARUTIL_LIBS = $(DIST)/lib/$(LIB_PREFIX)unicharutil_s.$(LIB_SUFFIX)
 MOZ_REGISTRY_LIBS          = $(DIST)/lib/$(LIB_PREFIX)mozreg_s.$(LIB_SUFFIX)
 MOZ_WIDGET_SUPPORT_LIBS    = $(DIST)/lib/$(LIB_PREFIX)widgetsupport_s.$(LIB_SUFFIX)
Index: mozilla/build/autoconf/nss.m4
===================================================================
RCS file: mozilla/build/autoconf/nss.m4
diff -N mozilla/build/autoconf/nss.m4
--- /dev/null	1 Jan 1970 00:00:00 -0000
+++ mozilla/build/autoconf/nss.m4	20 Dec 2005 09:31:36 -0000
@@ -0,0 +1,67 @@
+# -*- tab-width: 4; -*-
+# Configure paths for NSS
+# Public domain - Chris Seawood <cls@seawood.org> 2001-04-05
+# Based upon gtk.m4 (also PD) by Owen Taylor
+
+dnl AM_PATH_NSS([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND]]])
+dnl Test for NSS, and define NSS_CFLAGS and NSS_LIBS
+AC_DEFUN(AM_PATH_NSS,
+[dnl
+
+AC_ARG_WITH(nss-prefix,
+	[  --with-nss-prefix=PFX  Prefix where NSS is installed],
+	nss_config_prefix="$withval",
+	nss_config_prefix="")
+
+AC_ARG_WITH(nss-exec-prefix,
+	[  --with-nss-exec-prefix=PFX
+                          Exec prefix where NSS is installed],
+	nss_config_exec_prefix="$withval",
+	nss_config_exec_prefix="")
+
+	if test -n "$nss_config_exec_prefix"; then
+		nss_config_args="$nss_config_args --exec-prefix=$nss_config_exec_prefix"
+		if test -z "$NSS_CONFIG"; then
+			NSS_CONFIG=$nss_config_exec_prefix/bin/nss-config
+		fi
+	fi
+	if test -n "$nss_config_prefix"; then
+		nss_config_args="$nss_config_args --prefix=$nss_config_prefix"
+		if test -z "$NSS_CONFIG"; then
+			NSS_CONFIG=$nss_config_prefix/bin/nss-config
+		fi
+	fi
+
+	unset ac_cv_path_NSS_CONFIG
+	AC_PATH_PROG(NSS_CONFIG, nss-config, no)
+	min_nss_version=ifelse([$1], ,3.0.0,$1)
+	AC_MSG_CHECKING(for NSS - version >= $min_nss_version (skipping))
+
+	no_nss=""
+	if test "$NSS_CONFIG" = "no"; then
+		no_nss="yes"
+	else
+		NSS_CFLAGS=`$NSS_CONFIG $nss_config_args --cflags`
+		NSS_LIBS=`$NSS_CONFIG $nss_config_args --libs`
+
+		dnl Skip version check for now
+		nss_config_major_version=`$NSS_CONFIG $nss_config_args --version | \
+			sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\1/'`
+		nss_config_minor_version=`$NSS_CONFIG $nss_config_args --version | \
+			sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\2/'`
+		nss_config_micro_version=`$NSS_CONFIG $nss_config_args --version | \
+			sed 's/\([[0-9]]*\).\([[0-9]]*\).\([[0-9]]*\)/\3/'`
+	fi
+
+	if test -z "$no_nss"; then
+		AC_MSG_RESULT(yes)
+		ifelse([$2], , :, [$2])     
+	else
+		AC_MSG_RESULT(no)
+	fi
+
+
+	AC_SUBST(NSS_CFLAGS)
+	AC_SUBST(NSS_LIBS)
+
+])
Index: mozilla/security/manager/Makefile.in
===================================================================
RCS file: /cvsroot/mozilla/security/manager/Makefile.in,v
retrieving revision 1.59
diff -u -r1.59 Makefile.in
--- mozilla/security/manager/Makefile.in	2 Nov 2005 21:50:36 -0000	1.59
+++ mozilla/security/manager/Makefile.in	20 Dec 2005 09:31:37 -0000
@@ -46,6 +46,8 @@
 MODULE = psm
 
 PACKAGE_FILE = psm.pkg
+
+ifndef MOZ_NATIVE_NSS
 PACKAGE_VARS += \
 	NSS3_LIB \
 	SMIME3_LIB \
@@ -57,6 +59,7 @@
 	$(NULL)
 
 LOADABLE_ROOT_MODULE = $(DLL_PREFIX)nssckbi$(DLL_SUFFIX)
+endif
 
 NSS3_LIB = $(DLL_PREFIX)nss3$(DLL_SUFFIX)
 SMIME3_LIB = $(DLL_PREFIX)smime3$(DLL_SUFFIX)
@@ -150,6 +153,7 @@
 export:: .nss.cleaned
 
 .nss.cleaned: .nss.checkout
+ifndef MOZ_NATIVE_NSS
 	$(MAKE) -C $(topsrcdir)/security/coreconf $(DEFAULT_GMAKE_FLAGS) clean
 	$(MAKE) -C $(topsrcdir)/security/nss/lib $(DEFAULT_GMAKE_FLAGS) clean
 ifndef SKIP_CHK
@@ -157,9 +161,12 @@
 	$(MAKE) -C $(topsrcdir)/security/nss/cmd/shlibsign $(DEFAULT_GMAKE_FLAGS) clean
 endif
 	touch $@
+endif
 
 .nss.checkout:
+ifndef MOZ_NATIVE_NSS
 	touch $(srcdir)/$@
+endif
 
 dependclean export packages chrome::
 	$(MAKE) -C boot $@
@@ -170,12 +177,15 @@
 endif
 
 libs::
+ifndef MOZ_NATIVE_NSS
 	$(MAKE) -C $(topsrcdir)/security/coreconf $(DEFAULT_GMAKE_FLAGS)
+endif
 ifeq ($(OS_ARCH),WINNT)
 	cd $(DIST)/lib; cp -f $(LIB_PREFIX)dbm$(MOZ_BITS).$(LIB_SUFFIX) $(LIB_PREFIX)dbm.$(LIB_SUFFIX)
 else
 	cd $(DIST)/lib; cp -f $(LIB_PREFIX)mozdbm_s.$(LIB_SUFFIX) $(LIB_PREFIX)dbm.$(LIB_SUFFIX); $(RANLIB) $(LIB_PREFIX)dbm.$(LIB_SUFFIX)
 endif
+ifndef MOZ_NATIVE_NSS
 	$(MAKE) -C $(topsrcdir)/security/nss/lib $(DEFAULT_GMAKE_FLAGS)
 ifndef SKIP_CHK
 	$(MAKE) -C $(topsrcdir)/security/nss/cmd/lib $(DEFAULT_GMAKE_FLAGS)
@@ -195,6 +205,7 @@
 	$(INSTALL) -m 644 $(DIST)/lib/$(FREEBL_HYBRID_CHK) $(DIST)/bin
 	$(INSTALL) -m 755 $(DIST)/lib/$(FREEBL_HYBRID_MODULE) $(DIST)/bin
 endif
+endif
 	$(MAKE) -C boot $@
 	$(MAKE) -C ssl $@
 	$(MAKE) -C locales $@
@@ -203,6 +214,7 @@
 endif
 
 install::
+ifndef MOZ_NATIVE_NSS
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(LOADABLE_ROOT_MODULE) $(DESTDIR)$(mozappdir)
 ifndef SKIP_CHK
 	$(SYSINSTALL) -m 644 $(DIST)/lib/$(SOFTOKEN3_CHK) $(DESTDIR)$(mozappdir)
@@ -217,6 +229,7 @@
 	$(SYSINSTALL) -m 644 $(DIST)/lib/$(FREEBL_HYBRID_CHK) $(DESTDIR)$(mozappdir)
 	$(SYSINSTALL) -m 755 $(DIST)/lib/$(FREEBL_HYBRID_MODULE) $(DESTDIR)$(mozappdir)
 endif
+endif
 	$(MAKE) -C boot $@
 	$(MAKE) -C ssl $@
 	$(MAKE) -C locales $@
@@ -231,15 +244,18 @@
 ifdef MOZ_XUL
 	$(MAKE) -C pki $@
 endif
+ifndef MOZ_NATIVE_NSS
 	$(MAKE) -C $(topsrcdir)/security/coreconf $(DEFAULT_GMAKE_FLAGS) clean
 	$(MAKE) -C $(topsrcdir)/security/nss/lib $(DEFAULT_GMAKE_FLAGS) clean
 ifndef SKIP_CHK
 	$(MAKE) -C $(topsrcdir)/security/nss/cmd/lib $(DEFAULT_GMAKE_FLAGS) clean
 	$(MAKE) -C $(topsrcdir)/security/nss/cmd/shlibsign $(DEFAULT_GMAKE_FLAGS) clean
 endif
+endif
 
 echo-requires-recursive::
 	$(MAKE) -C boot $@
 	$(MAKE) -C ssl $@
 	$(MAKE) -C pki $@
 	$(MAKE) -C locales $@
+
Index: mozilla/security/manager/ssl/src/Makefile.in
===================================================================
RCS file: /cvsroot/mozilla/security/manager/ssl/src/Makefile.in,v
retrieving revision 1.68
diff -u -r1.68 Makefile.in
--- mozilla/security/manager/ssl/src/Makefile.in	1 Sep 2005 12:43:58 -0000	1.68
+++ mozilla/security/manager/ssl/src/Makefile.in	20 Dec 2005 09:31:37 -0000
@@ -123,8 +123,7 @@
 
 # Use local includes because they are inserted before INCLUDES
 # so that Mozilla's nss.h is used, not glibc's
-LOCAL_INCLUDES += -I$(DIST)/public/nss \
-                  $(NULL)
+LOCAL_INCLUDES = $(NSS_CFLAGS)
 
 EXTRA_DSO_LDOPTS += \
 		$(MOZ_UNICHARUTIL_LIBS) \
Index: mozilla/security/manager/ssl/src/nsNSSComponent.cpp
===================================================================
RCS file: /cvsroot/mozilla/security/manager/ssl/src/nsNSSComponent.cpp,v
retrieving revision 1.129
diff -u -r1.129 nsNSSComponent.cpp
--- mozilla/security/manager/ssl/src/nsNSSComponent.cpp	14 Nov 2005 20:09:49 -0000	1.129
+++ mozilla/security/manager/ssl/src/nsNSSComponent.cpp	20 Dec 2005 09:31:39 -0000
@@ -485,14 +485,6 @@
 }
 
 
-#ifdef XP_MAC
-#ifdef DEBUG
-#define LOADABLE_CERTS_MODULE NS_LITERAL_CSTRING("NSSckbiDebug.shlb")
-#else
-#define LOADABLE_CERTS_MODULE NS_LITERAL_CSTRING("NSSckbi.shlb")
-#endif /*DEBUG*/ 
-#endif /*XP_MAC*/
-
 static void setOCSPOptions(nsIPrefBranch * pref);
 
 NS_IMETHODIMP
@@ -686,40 +678,42 @@
 
     const char *possible_ckbi_locations[] = {
       NS_GRE_DIR,
-      NS_XPCOM_CURRENT_PROCESS_DIR
+      NS_XPCOM_CURRENT_PROCESS_DIR,
+      0 // This special value means: 
+        //   search for ckbi in the directories on the shared
+        //   library/DLL search path
     };
-    
+
     for (size_t il = 0; il < sizeof(possible_ckbi_locations)/sizeof(const char*); ++il) {
       nsCOMPtr<nsILocalFile> mozFile;
-      directoryService->Get( possible_ckbi_locations[il],
-                             NS_GET_IID(nsILocalFile), 
-                             getter_AddRefs(mozFile));
+      char *fullModuleName = nsnull;
+
+      if (!possible_ckbi_locations[il])
+      {
+        fullModuleName = PR_GetLibraryName(nsnull, "nssckbi");
+      }
+      else
+      {
+        directoryService->Get( possible_ckbi_locations[il],
+                               NS_GET_IID(nsILocalFile), 
+                               getter_AddRefs(mozFile));
     
-      if (!mozFile) {
-        continue;
+        if (!mozFile) {
+          continue;
+        }
+
+        nsCAutoString processDir;
+        mozFile->GetNativePath(processDir);
+        fullModuleName = PR_GetLibraryName(processDir.get(), "nssckbi");
       }
 
-      char *fullModuleName = nsnull;
-#ifdef XP_MAC
-      nsCAutoString nativePath;
-      mozFile->AppendNative(NS_LITERAL_CSTRING("Essential Files"));
-      mozFile->AppendNative(LOADABLE_CERTS_MODULE);
-      mozFile->GetNativePath(nativePath);    
-      fullModuleName = (char *) nativePath.get();
-#else
-      nsCAutoString processDir;
-      mozFile->GetNativePath(processDir);
-      fullModuleName = PR_GetLibraryName(processDir.get(), "nssckbi");
-#endif
       /* If a module exists with the same name, delete it. */
       NS_ConvertUCS2toUTF8 modNameUTF8(modName);
       int modType;
       SECMOD_DeleteModule(NS_CONST_CAST(char*, modNameUTF8.get()), &modType);
       SECStatus rv_add = 
         SECMOD_AddNewModule(NS_CONST_CAST(char*, modNameUTF8.get()), fullModuleName, 0, 0);
-#ifndef XP_MAC
-      PR_Free(fullModuleName); // allocated by NSPR
-#endif
+      PR_FreeLibraryName(fullModuleName); // allocated by NSPR
       if (SECSuccess == rv_add) {
         // found a module, no need to try other directories
         break;