$ git diff --patch-with-stat --summary 3dc0768a985fb5bb419acafcbbd489198a846a73..f0fef6dd5faa2fa8676248661c46658ce50a23a0

 .abf.yml |  2 +-
 nss.spec | 34 ++++++++++++++++++++++++++++++++--
 2 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/.abf.yml b/.abf.yml
index 5bf53ca..3f45418 100644
--- a/.abf.yml
+++ b/.abf.yml
@@ -3,5 +3,5 @@ sources:
   blank-cert8.db: d272a7b58364862613d44261c5744f7a336bf177
   blank-key3.db: 7f78b5bcecdb5005e7b803604b2ec9d1a9df2fb5
   blank-secmod.db: bd748cf6e1465a1bbe6e751b72ffc0076aff0b50
-  nss-3.88.1.tar.gz: cbbd99de26c74e6cd227f394d9905dd53fc13f30
+  nss-3.90.tar.gz: 1e7d2f16655281cfb2972688af1605e0de302481
   verisign-class-3-secure-server-ca.der: 188590e94878478e33b6194e59fbbb28ff0888d5
diff --git a/nss.spec b/nss.spec
index 66e7b81..7239cad 100644
--- a/nss.spec
+++ b/nss.spec
@@ -24,7 +24,7 @@
 Summary:	Network Security Services
 Name:		nss
 Epoch:		1
-Version:	3.88.1
+Version:	3.90
 Release:	1
 Group:		System/Libraries
 License:	MPL or GPLv2+ or LGPLv2+
@@ -129,7 +129,7 @@ libnssutil3, libsmime3, and libssl3.
 %package -n %{libfreebl}
 Summary:	Network Security Services (NSS)
 Group:		System/Libraries
-Requires(post): nss-shlibsign
+Requires(post):	nss-shlibsign
 
 %description -n %{libfreebl}
 This package contains the shared libraries libfreebl3 and libsoftokn3.
@@ -422,6 +422,36 @@ install -m 644 %{SOURCE12} %{buildroot}%{_sysconfdir}/pki/nssdb/secmod.db
 install -m0755 libnssckbi_empty.so %{buildroot}/%{_libdir}/libnssckbi_empty.so
 %endif
 
+# (tpg) strip LTO from "LLVM IR bitcode" files
+check_convert_bitcode() {
+    printf '%s\n' "Checking for LLVM IR bitcode"
+    llvm_file_name=$(realpath ${1})
+    llvm_file_type=$(file ${llvm_file_name})
+
+    if printf '%s\n' "${llvm_file_type}" | grep -q "LLVM IR bitcode"; then
+# recompile without LTO
+    clang %{optflags} -fno-lto -Wno-unused-command-line-argument -x ir ${llvm_file_name} -c -o ${llvm_file_name}
+    elif printf '%s\n' "${llvm_file_type}" | grep -q "current ar archive"; then
+    printf '%s\n' "Unpacking ar archive ${llvm_file_name} to check for LLVM bitcode components."
+# create archive stage for objects
+    archive_stage=$(mktemp -d)
+    archive=${llvm_file_name}
+    cd ${archive_stage}
+    ar x ${archive}
+    for archived_file in $(find -not -type d); do
+        check_convert_bitcode ${archived_file}
+        printf '%s\n' "Repacking ${archived_file} into ${archive}."
+        ar r ${archive} ${archived_file}
+    done
+    ranlib ${archive}
+    cd ..
+    fi
+}
+
+for i in $(find %{buildroot} -type f -name "*.[ao]"); do
+    check_convert_bitcode ${i}
+done
+
 %if %{with lib}
 %post -n %{libname} -p <lua>
 -- (tpg) execute only on install