ftp://ftp.mozilla.org/pub/mozilla.org/security/jss/releases/ If this is not API compatible with 3.4 (which it probably isn'). We should add 3.7 too.
Seems they do not do source releases since 3.4 so we need to package from CVS tags.
4.2 committed. Almost API compatible and ldapsdk that is the only thing using it compiles fine so in the same slot.