diff options
| -rw-r--r-- | gnu/packages/nss.scm | 221 | ||||
| -rw-r--r-- | gnu/packages/patches/nss-3.56-pkgconfig.patch | 187 | ||||
| -rw-r--r-- | gnu/packages/patches/nss-increase-test-timeout.patch | 4 |
3 files changed, 244 insertions, 168 deletions
diff --git a/gnu/packages/nss.scm b/gnu/packages/nss.scm index 0444b47071..e054363e9f 100644 --- a/gnu/packages/nss.scm +++ b/gnu/packages/nss.scm @@ -5,6 +5,7 @@ ;;; Copyright © 2017, 2018 Tobias Geerinckx-Rice <me@tobias.gr> ;;; Copyright © 2020 Marius Bakke <mbakke@fastmail.com> ;;; Copyright © 2020 Jonathan Brielmaier <jonathan.brielmaier@web.de> +;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com> ;;; ;;; This file is part of GNU Guix. ;;; @@ -24,6 +25,8 @@ (define-module (gnu packages nss) #:use-module (guix packages) #:use-module (guix download) + #:use-module (guix git-download) + #:use-module (guix hg-download) #:use-module (guix build-system gnu) #:use-module ((guix licenses) #:prefix license:) #:use-module (gnu packages) @@ -70,116 +73,124 @@ platform-neutral API for system level and libc-like functions. It is used in the Mozilla clients.") (license license:mpl2.0))) +;;; Note: When updating, also test the build of the nss-certs package, which +;;; uses the same source as nss. (define-public nss - (package - (name "nss") - (version "3.59") - (source (origin - (method url-fetch) - (uri (let ((version-with-underscores - (string-join (string-split version #\.) "_"))) - (string-append - "https://ftp.mozilla.org/pub/mozilla.org/security/nss/" - "releases/NSS_" version-with-underscores "_RTM/src/" - "nss-" version ".tar.gz"))) - (sha256 - (base32 - "096fs3z21r171q24ca3rq53p1389xmvqz1f2rpm7nlm8r9s82ag6")) - ;; Create nss.pc and nss-config. - (patches (search-patches "nss-3.56-pkgconfig.patch" - "nss-increase-test-timeout.patch")) - (modules '((guix build utils))) - (snippet - '(begin - ;; Delete the bundled copy of these libraries. - (delete-file-recursively "nss/lib/zlib") - (delete-file-recursively "nss/lib/sqlite") - #t)))) - (build-system gnu-build-system) - (outputs '("out" "bin")) - (arguments - `(#:parallel-build? #f ; not supported - #:make-flags - (let* ((out (assoc-ref %outputs "out")) - (nspr (string-append (assoc-ref %build-inputs "nspr"))) - (rpath (string-append "-Wl,-rpath=" out "/lib/nss"))) - (list "-C" "nss" (string-append "PREFIX=" out) - "NSDISTMODE=copy" - "NSS_USE_SYSTEM_SQLITE=1" - (string-append "NSPR_INCLUDE_DIR=" nspr "/include/nspr") - ;; Add $out/lib/nss to RPATH. - (string-append "RPATH=" rpath) - (string-append "LDFLAGS=" rpath))) - #:modules ((guix build gnu-build-system) - (guix build utils) - (ice-9 ftw) - (ice-9 match) - (srfi srfi-26)) - #:phases - (modify-phases %standard-phases - (replace 'configure - (lambda _ - (setenv "CC" "gcc") - ;; Tells NSS to build for the 64-bit ABI if we are 64-bit system. - ,@(match (%current-system) - ((or "x86_64-linux" "aarch64-linux") - `((setenv "USE_64" "1"))) - (_ - '())) - #t)) - (replace 'check - (lambda _ - ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for testing. - ;; The later requires a working DNS or /etc/hosts. - (setenv "DOMSUF" "localdomain") - (setenv "USE_IP" "TRUE") - (setenv "IP_ADDRESS" "127.0.0.1") + ;; Use the latest commit to get this fix: + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1686134, which caused test + ;; failures. A simple patch cannot be used, as git binary diffs is not + ;; supported. + (let ((revision "1") + (changeset "92dcda94c1d4688edad2c094d505cd253757c0d4")) + (package + (name "nss") + (version (git-version "3.61" revision changeset)) + (source (origin + (method hg-fetch) + (uri (hg-reference + (url "https://hg.mozilla.org/projects/nss") + (changeset changeset))) + (sha256 + (base32 + "0j3hnsfw1855x150zgdyf3d6wapiph80rmbvc34ykpp3j347q5hb")) + (file-name (git-file-name name version)) + ;; Create nss.pc and nss-config. + (patches (search-patches "nss-3.56-pkgconfig.patch" + "nss-increase-test-timeout.patch")) + (modules '((guix build utils))) + (snippet + '(begin + ;; Delete the bundled copy of these libraries. + (delete-file-recursively "lib/zlib") + (delete-file-recursively "lib/sqlite"))))) + (build-system gnu-build-system) + (outputs '("out" "bin")) + (arguments + ;; Parallel builds are not supported (see: + ;; https://bugzilla.mozilla.org/show_bug.cgi?id=1640328). + `(#:parallel-build? #f + #:tests? #t ;requires at least one hour to run + #:make-flags + (let* ((out (assoc-ref %outputs "out")) + (nspr (string-append (assoc-ref %build-inputs "nspr"))) + (rpath (string-append "-Wl,-rpath=" out "/lib/nss"))) + (list (string-append "PREFIX=" out) + "NSDISTMODE=copy" + "NSS_USE_SYSTEM_SQLITE=1" + (string-append "NSPR_INCLUDE_DIR=" nspr "/include/nspr") + ;; Add $out/lib/nss to RPATH. + (string-append "RPATH=" rpath) + (string-append "LDFLAGS=" rpath))) + #:modules ((guix build gnu-build-system) + (guix build utils) + (ice-9 ftw) + (ice-9 match) + (srfi srfi-26)) + #:phases + (modify-phases %standard-phases + (replace 'configure + (lambda _ + (setenv "CC" "gcc") + ;; Tells NSS to build for the 64-bit ABI if we are 64-bit system. + ,@(match (%current-system) + ((or "x86_64-linux" "aarch64-linux") + `((setenv "USE_64" "1"))) + (_ + '())))) + (replace 'check + (lambda* (#:key tests? #:allow-other-keys) + (when tests? + ;; Use 127.0.0.1 instead of $HOST.$DOMSUF as HOSTADDR for testing. + ;; The later requires a working DNS or /etc/hosts. + (setenv "DOMSUF" "localdomain") + (setenv "USE_IP" "TRUE") + (setenv "IP_ADDRESS" "127.0.0.1") - ;; The "PayPalEE.cert" certificate expires every six months, - ;; leading to test failures: - ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To - ;; work around that, set the time to roughly the release date. - (invoke "faketime" "2020-11-01" "./nss/tests/all.sh"))) - (replace 'install - (lambda* (#:key outputs #:allow-other-keys) - (let* ((out (assoc-ref outputs "out")) - (bin (string-append (assoc-ref outputs "bin") "/bin")) - (inc (string-append out "/include/nss")) - (lib (string-append out "/lib/nss")) - (obj (match (scandir "dist" (cut string-suffix? "OBJ" <>)) - ((obj) (string-append "dist/" obj))))) - ;; Install nss-config to $out/bin. - (install-file (string-append obj "/bin/nss-config") - (string-append out "/bin")) - (delete-file (string-append obj "/bin/nss-config")) - ;; Install nss.pc to $out/lib/pkgconfig. - (install-file (string-append obj "/lib/pkgconfig/nss.pc") - (string-append out "/lib/pkgconfig")) - (delete-file (string-append obj "/lib/pkgconfig/nss.pc")) - (rmdir (string-append obj "/lib/pkgconfig")) - ;; Install other files. - (copy-recursively "dist/public/nss" inc) - (copy-recursively (string-append obj "/bin") bin) - (copy-recursively (string-append obj "/lib") lib) - #t)))))) - (inputs - `(("sqlite" ,sqlite) - ("zlib" ,zlib))) - (propagated-inputs `(("nspr" ,nspr))) ; required by nss.pc. - (native-inputs `(("perl" ,perl) - ("libfaketime" ,libfaketime))) ;for tests + ;; The "PayPalEE.cert" certificate expires every six months, + ;; leading to test failures: + ;; <https://bugzilla.mozilla.org/show_bug.cgi?id=609734>. To + ;; work around that, set the time to roughly the release date. + (invoke "faketime" "2021-01-22" "./tests/all.sh")))) + (replace 'install + (lambda* (#:key outputs #:allow-other-keys) + (let* ((out (assoc-ref outputs "out")) + (bin (string-append (assoc-ref outputs "bin") "/bin")) + (inc (string-append out "/include/nss")) + (lib (string-append out "/lib/nss")) + (obj (match (scandir "../dist" (cut string-suffix? "OBJ" <>)) + ((obj) (string-append "../dist/" obj))))) + ;; Install nss-config to $out/bin. + (install-file (string-append obj "/bin/nss-config") + (string-append out "/bin")) + (delete-file (string-append obj "/bin/nss-config")) + ;; Install nss.pc to $out/lib/pkgconfig. + (install-file (string-append obj "/lib/pkgconfig/nss.pc") + (string-append out "/lib/pkgconfig")) + (delete-file (string-append obj "/lib/pkgconfig/nss.pc")) + (rmdir (string-append obj "/lib/pkgconfig")) + ;; Install other files. + (mkdir-p inc) + (copy-recursively "../dist/public/nss" inc) + (copy-recursively (string-append obj "/bin") bin) + (copy-recursively (string-append obj "/lib") lib))))))) + (inputs + `(("sqlite" ,sqlite) + ("zlib" ,zlib))) + (propagated-inputs `(("nspr" ,nspr))) ; required by nss.pc. + (native-inputs `(("perl" ,perl) + ("libfaketime" ,libfaketime))) ;for tests - ;; The NSS test suite takes around 48 hours on Loongson 3A (MIPS) when - ;; another build is happening concurrently on the same machine. - (properties '((timeout . 216000))) ; 60 hours + ;; The NSS test suite takes around 48 hours on Loongson 3A (MIPS) when + ;; another build is happening concurrently on the same machine. + (properties '((timeout . 216000))) ; 60 hours - (home-page - "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS") - (synopsis "Network Security Services") - (description - "Network Security Services (@dfn{NSS}) is a set of libraries designed to + (home-page + "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS") + (synopsis "Network Security Services") + (description + "Network Security Services (@dfn{NSS}) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Applications built with NSS can support SSL v2 and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3 certificates, and other security standards.") - (license license:mpl2.0))) + (license license:mpl2.0)))) diff --git a/gnu/packages/patches/nss-3.56-pkgconfig.patch b/gnu/packages/patches/nss-3.56-pkgconfig.patch index 91b6aef604..df3f474aec 100644 --- a/gnu/packages/patches/nss-3.56-pkgconfig.patch +++ b/gnu/packages/patches/nss-3.56-pkgconfig.patch @@ -1,25 +1,79 @@ -Description: Create nss.pc and nss-config -Author: Lars Wendler <polynomial-c@gentoo.org> -Source: http://sources.gentoo.org/cgi-bin/viewvc.cgi/gentoo-x86/dev-libs/nss/files/nss-3.17.1-gentoo-fixups.patch +From 1b3c48499abb000d708abe5f05413c1f4155e086 Mon Sep 17 00:00:00 2001 +From: Jory Pratt <anarchy@gentoo.org> +Date: Mon, 8 Jun 2020 12:22:29 -0500 +Subject: [PATCH] Add pkg-config and nss-config for Gentoo -Modifications: - Change libdir from ${prefix}/lib64 to ${prefix}/lib/nss. - Remove optional patching in nss/Makefile. - Include -L$libdir in output from "nss-config --libs". +Modifications to use with Guix and the latest NSS source checkout code: use +'install' instead of 'ln -sf' and adapt the relative file names. -Later adapted to apply cleanly to nss-3.53. +--- + Makefile | 15 +---- + config/Makefile | 40 ++++++++++++ + config/nss-config.in | 145 +++++++++++++++++++++++++++++++++++++++++++ + config/nss.pc.in | 12 ++++ + manifest.mn | 2 +- + 5 files changed, 200 insertions(+), 14 deletions(-) + create mode 100644 config/Makefile + create mode 100644 config/nss-config.in + create mode 100644 config/nss.pc.in ---- nss-3.21/nss/config/Makefile -+++ nss-3.21/nss/config/Makefile +diff --git a/Makefile b/Makefile +index eb4ed1a..f979d90 100644 +--- a/Makefile ++++ b/Makefile +@@ -4,6 +4,8 @@ + # License, v. 2.0. If a copy of the MPL was not distributed with this + # file, You can obtain one at http://mozilla.org/MPL/2.0/. + ++default: nss_build_all ++ + ####################################################################### + # (1) Include initial platform-independent assignments (MANDATORY). # + ####################################################################### +@@ -48,12 +50,9 @@ include $(CORE_DEPTH)/coreconf/rules.mk + ####################################################################### + + nss_build_all: +- $(MAKE) build_nspr + $(MAKE) all +- $(MAKE) latest + + nss_clean_all: +- $(MAKE) clobber_nspr + $(MAKE) clobber + + NSPR_CONFIG_STATUS = $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)/config.status +@@ -138,16 +137,6 @@ $(NSPR_CONFIG_STATUS): $(NSPR_CONFIGURE) + --prefix='$(NSS_GYP_PREFIX)' + endif + +-build_nspr: $(NSPR_CONFIG_STATUS) +- $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME) +- $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME)/pr/tests +- +-install_nspr: build_nspr +- $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME) install +- +-clobber_nspr: $(NSPR_CONFIG_STATUS) +- $(MAKE) -C $(CORE_DEPTH)/../nspr/$(OBJDIR_NAME) clobber +- + build_docs: + $(MAKE) -C $(CORE_DEPTH)/doc + +diff --git a/config/Makefile b/config/Makefile +new file mode 100644 +index 0000000..aaf1991 +--- /dev/null ++++ b/config/Makefile @@ -0,0 +1,40 @@ +CORE_DEPTH = .. +DEPTH = .. + +include $(CORE_DEPTH)/coreconf/config.mk + -+NSS_MAJOR_VERSION = `grep "NSS_VMAJOR" ../lib/nss/nss.h | awk '{print $$3}'` -+NSS_MINOR_VERSION = `grep "NSS_VMINOR" ../lib/nss/nss.h | awk '{print $$3}'` -+NSS_PATCH_VERSION = `grep "NSS_VPATCH" ../lib/nss/nss.h | awk '{print $$3}'` ++NSS_MAJOR_VERSION = $(shell grep -F "NSS_VMAJOR" ../lib/nss/nss.h | awk '{print $$3}') ++NSS_MINOR_VERSION = $(shell grep -F "NSS_VMINOR" ../lib/nss/nss.h | awk '{print $$3}') ++NSS_PATCH_VERSION = $(shell grep -F "NSS_VPATCH" ../lib/nss/nss.h | awk '{print $$3}') +PREFIX = /usr + +all: export libs @@ -29,14 +83,14 @@ Later adapted to apply cleanly to nss-3.53. + mkdir -p $(DIST)/lib/pkgconfig + sed -e "s,@prefix@,$(PREFIX)," \ + -e "s,@exec_prefix@,\$${prefix}," \ -+ -e "s,@libdir@,\$${prefix}/lib/nss," \ ++ -e "s,@libdir@,\$${prefix}/lib64," \ + -e "s,@includedir@,\$${prefix}/include/nss," \ + -e "s,@NSS_MAJOR_VERSION@,$(NSS_MAJOR_VERSION),g" \ + -e "s,@NSS_MINOR_VERSION@,$(NSS_MINOR_VERSION)," \ + -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \ + nss.pc.in > nss.pc + chmod 0644 nss.pc -+ cp nss.pc $(DIST)/lib/pkgconfig ++ install nss.pc $(DIST)/lib/pkgconfig + + # Create the nss-config script + mkdir -p $(DIST)/bin @@ -46,14 +100,17 @@ Later adapted to apply cleanly to nss-3.53. + -e "s,@NSS_PATCH_VERSION@,$(NSS_PATCH_VERSION)," \ + nss-config.in > nss-config + chmod 0755 nss-config -+ cp nss-config $(DIST)/bin ++ install nss-config $(DIST)/bin + +libs: + +dummy: all export libs + ---- nss-3.21/nss/config/nss-config.in -+++ nss-3.21/nss/config/nss-config.in +diff --git a/config/nss-config.in b/config/nss-config.in +new file mode 100644 +index 0000000..3a957b8 +--- /dev/null ++++ b/config/nss-config.in @@ -0,0 +1,145 @@ +#!/bin/sh + @@ -95,31 +152,31 @@ Later adapted to apply cleanly to nss-3.53. + +while test $# -gt 0; do + case "$1" in -+ -*=*) optarg=`echo "$1" | sed 's/[-_a-zA-Z0-9]*=//'` ;; ++ -*=*) optarg=$(echo "$1" | sed 's/[-_a-zA-Z0-9]*=//') ;; + *) optarg= ;; + esac + + case $1 in + --prefix=*) -+ prefix=$optarg ++ prefix=${optarg} + ;; + --prefix) + echo_prefix=yes + ;; + --exec-prefix=*) -+ exec_prefix=$optarg ++ exec_prefix=${optarg} + ;; + --exec-prefix) + echo_exec_prefix=yes + ;; + --includedir=*) -+ includedir=$optarg ++ includedir=${optarg} + ;; + --includedir) + echo_includedir=yes + ;; + --libdir=*) -+ libdir=$optarg ++ libdir=${optarg} + ;; + --libdir) + echo_libdir=yes @@ -153,55 +210,58 @@ Later adapted to apply cleanly to nss-3.53. +done + +# Set variables that may be dependent upon other variables -+if test -z "$exec_prefix"; then -+ exec_prefix=`pkg-config --variable=exec_prefix nss` ++if test -z "${exec_prefix}"; then ++ exec_prefix=$(pkg-config --variable=exec_prefix nss) +fi -+if test -z "$includedir"; then -+ includedir=`pkg-config --variable=includedir nss` ++if test -z "${includedir}"; then ++ includedir=$(pkg-config --variable=includedir nss) +fi -+if test -z "$libdir"; then -+ libdir=`pkg-config --variable=libdir nss` ++if test -z "${libdir}"; then ++ libdir=$(pkg-config --variable=libdir nss) +fi + -+if test "$echo_prefix" = "yes"; then -+ echo $prefix ++if test "${echo_prefix}" = "yes"; then ++ echo ${prefix} +fi + -+if test "$echo_exec_prefix" = "yes"; then -+ echo $exec_prefix ++if test "${echo_exec_prefix}" = "yes"; then ++ echo ${exec_prefix} +fi + -+if test "$echo_includedir" = "yes"; then -+ echo $includedir ++if test "${echo_includedir}" = "yes"; then ++ echo ${includedir} +fi + -+if test "$echo_libdir" = "yes"; then -+ echo $libdir ++if test "${echo_libdir}" = "yes"; then ++ echo ${libdir} +fi + -+if test "$echo_cflags" = "yes"; then -+ echo -I$includedir ++if test "${echo_cflags}" = "yes"; then ++ echo -I${includedir} +fi + -+if test "$echo_libs" = "yes"; then -+ libdirs=-L$libdir -+ if test -n "$lib_ssl"; then -+ libdirs="$libdirs -lssl${major_version}" ++if test "${echo_libs}" = "yes"; then ++ libdirs="" ++ if test -n "${lib_ssl}"; then ++ libdirs="${libdirs} -lssl${major_version}" + fi -+ if test -n "$lib_smime"; then -+ libdirs="$libdirs -lsmime${major_version}" ++ if test -n "${lib_smime}"; then ++ libdirs="${libdirs} -lsmime${major_version}" + fi -+ if test -n "$lib_nss"; then -+ libdirs="$libdirs -lnss${major_version}" ++ if test -n "${lib_nss}"; then ++ libdirs="${libdirs} -lnss${major_version}" + fi -+ if test -n "$lib_nssutil"; then -+ libdirs="$libdirs -lnssutil${major_version}" ++ if test -n "${lib_nssutil}"; then ++ libdirs="${libdirs} -lnssutil${major_version}" + fi -+ echo $libdirs ++ echo ${libdirs} +fi + ---- nss-3.21/nss/config/nss.pc.in -+++ nss-3.21/nss/config/nss.pc.in +diff --git a/config/nss.pc.in b/config/nss.pc.in +new file mode 100644 +index 0000000..03f1e39 +--- /dev/null ++++ b/config/nss.pc.in @@ -0,0 +1,12 @@ +prefix=@prefix@ +exec_prefix=@exec_prefix@ @@ -211,18 +271,23 @@ Later adapted to apply cleanly to nss-3.53. +Name: NSS +Description: Network Security Services +Version: @NSS_MAJOR_VERSION@.@NSS_MINOR_VERSION@.@NSS_PATCH_VERSION@ -+Requires: nspr >= 4.8 -+Libs: -L${libdir} -lssl3 -lsmime3 -lnss3 -lnssutil3 ++Requires: nspr >= 4.25 ++Libs: -lssl3 -lsmime3 -lnss3 -lnssutil3 +Cflags: -I${includedir} + ---- nss-3.21/nss/manifest.mn -+++ nss-3.21/nss/manifest.mn -@@ -10,7 +10,7 @@ - +diff --git a/manifest.mn b/manifest.mn +index dada8ab..72dc9b3 100644 +--- a/manifest.mn ++++ b/manifest.mn +@@ -10,7 +10,7 @@ IMPORTS = nspr20/v4.8 \ + RELEASE = nss - + -DIRS = coreconf lib cmd cpputil gtests -+DIRS = coreconf lib cmd cpputil gtests config - ++DIRS = coreconf lib cmd cpputil config + lib: coreconf cmd: lib +-- +2.26.2 + diff --git a/gnu/packages/patches/nss-increase-test-timeout.patch b/gnu/packages/patches/nss-increase-test-timeout.patch index 55117c02e9..1f6dd42bd7 100644 --- a/gnu/packages/patches/nss-increase-test-timeout.patch +++ b/gnu/packages/patches/nss-increase-test-timeout.patch @@ -3,8 +3,8 @@ machine. Even a busy x86_64 machine can use more than 5s on some tests. Increase timeouts to increase chances of a successful build. ---- a/nss/gtests/ssl_gtest/tls_connect.cc 2017-03-14 22:47:30.855813629 +0100 -+++ b/nss/gtests/ssl_gtest/tls_connect.cc 2017-03-14 22:48:49.042335273 +0100 +--- a/gtests/ssl_gtest/tls_connect.cc 2017-03-14 22:47:30.855813629 +0100 ++++ b/gtests/ssl_gtest/tls_connect.cc 2017-03-14 22:48:49.042335273 +0100 @@ -245,7 +245,7 @@ ASSERT_TRUE_WAIT((client_->state() != TlsAgent::STATE_CONNECTING) && |