Bug 1347336 - decouple nss-pem from the nss package
Summary: decouple nss-pem from the nss package
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: nss
Version: 23
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On: 1346806
Blocks: 1382743
TreeView+ depends on / blocked
 
Reported: 2016-06-16 14:33 UTC by Kamil Dudka
Modified: 2016-11-30 09:11 UTC (History)
4 users (show)

Fixed In Version: nss-3.25.0-1.2.fc24 nss-3.25.0-1.2.fc23
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-18 00:51:00 UTC
Type: Bug


Attachments (Terms of Use)
[PATCH] decouple nss-pem from the nss package (6.75 KB, patch)
2016-06-16 14:35 UTC, Kamil Dudka
no flags Details | Diff
dist-git commit for f24 (10.29 KB, patch)
2016-07-20 11:24 UTC, Kamil Dudka
no flags Details | Diff
dist-git commits for f23 (11.43 KB, patch)
2016-07-20 11:25 UTC, Kamil Dudka
no flags Details | Diff

Description Kamil Dudka 2016-06-16 14:33:28 UTC
I have created a standalone nss-pem package in Fedora, which makes it possible (and necessary) to remove the bundled nss-pem library from the nss package.  Please consider applying the attached patch on the rawhide branch of nss.

Comment 1 Kamil Dudka 2016-06-16 14:35:25 UTC
Created attachment 1168757 [details]
[PATCH] decouple nss-pem from the nss package

Comment 3 Kai Engert (:kaie) (inactive account) 2016-06-28 10:43:38 UTC
Did everything work fine? Then we should proceed to cleanup the (now) unnecessary files.

Comment 4 Kamil Dudka 2016-06-28 11:24:33 UTC
(In reply to Kai Engert (:kaie) from comment #3)
> Did everything work fine?

I am not aware of any issues so far.

> Then we should proceed to cleanup the (now) unnecessary files.

Yes, please remove them.  We can always get them from the git repository in case they appear to be needed later on.

Are you open to make the transition also in the released versions of Fedora?

I guess that nss is going to be rebased there anyway.  The only issue is that we need to cooperate more on the update:

1) Modify the Conflicts tag in nss-pem.spec to match the first version-release of nss that does not bundle nss-pem.

2) Submit the update for nss and nss-pem together in one batch (to preserve atomicity of the update).

Comment 5 Kai Engert (:kaie) (inactive account) 2016-06-28 11:42:20 UTC
(In reply to Kamil Dudka from comment #4)
> Are you open to make the transition also in the released versions of Fedora?

I'm open, but it would be nice to do it in smaller steps.

We could do Fedora 25 immediately,
and also do it for Fedora 24 together with a rebase to NSS 3.25.

Maybe we should wait until the Fedora 24 update has been shipped as stable, prior to updating anything that's older?

Comment 6 Kai Engert (:kaie) (inactive account) 2016-06-28 12:04:58 UTC
Your patch changes this line:
  %setup -q -T -D -n %{name}-%{version} -a 12

and removes the "-a 12".

However, I think this line must be removed completely. After removing of nss-pem*.tar we only have one source archive left.

Comment 7 Kai Engert (:kaie) (inactive account) 2016-06-28 12:13:44 UTC
Elio:

(a) please "git rm nss-pem-unitialized-vars.path"

(b) please remove the following obsolete line 
    from the %prep section of nss.spec:
       %setup -q -T -D -n %{name}-%{version}

Comment 8 Kai Engert (:kaie) (inactive account) 2016-06-28 12:17:42 UTC
(In reply to Kai Engert (:kaie) from comment #7)
> Elio:
> 
> (a) please "git rm nss-pem-unitialized-vars.path"
> 
> (b) please remove the following obsolete line 
>     from the %prep section of nss.spec:
>        %setup -q -T -D -n %{name}-%{version}

This request was for the "master branch", the only branch where we already have applied this decoupling.

Comment 9 Kai Engert (:kaie) (inactive account) 2016-06-28 12:18:15 UTC
Kamil, I see that Elio has already started rebasing the various Fedora branches to NSS 3.25

I suggest that we wait until Elio is done with the rebase task, to avoid risk for confusion and mistakes.

Comment 10 Kamil Dudka 2016-06-28 12:19:00 UTC
(In reply to Kai Engert (:kaie) from comment #5)
> We could do Fedora 25 immediately,

Fedora 25 is already done ;-)

> and also do it for Fedora 24 together with a rebase to NSS 3.25.
> 
> Maybe we should wait until the Fedora 24 update has been shipped as stable,
> prior to updating anything that's older?

Sounds good.  I have reopened this bug to track the progress.  Just let me know once you are ready to include it and I will prepare a build of nss-pem for the update.

Comment 11 Kamil Dudka 2016-06-28 12:24:08 UTC
(In reply to Kai Engert (:kaie) from comment #6)
> Your patch changes this line:
>   %setup -q -T -D -n %{name}-%{version} -a 12
> 
> and removes the "-a 12".
> 
> However, I think this line must be removed completely.

True.  The whole line can be removed (though it is harmless).

Comment 12 Elio Maldonado Batiz 2016-06-28 14:05:35 UTC
(In reply to Kai Engert (:kaie) from comment #7)
> Elio:
> 
> (a) please "git rm nss-pem-unitialized-vars.path"
> 
> (b) please remove the following obsolete line 
>     from the %prep section of nss.spec:
>        %setup -q -T -D -n %{name}-%{version}

Yes, they be gone in the next build, and also remove this obsolete comment
# link pem against buildroot's freebl, essential when mixing and matching

Comment 13 Kai Engert (:kaie) (inactive account) 2016-07-01 12:33:22 UTC
Kamil, it has been suggested to limit this change to Fedora 24 and newer, in order to avoid the workload of maintaining older branches.

Is this acceptable to you?

Comment 14 Kamil Dudka 2016-07-07 07:56:49 UTC
As discussed off Bugzilla, Elio is fine with pushing this change also to f23.  It will ease fixing nss-pem bugs in the future, especially for nss maintainers.

Comment 15 Kai Engert (:kaie) (inactive account) 2016-07-19 14:29:51 UTC
Hello Kamil, the F24 and F23 updates are ready, so it seems we're ready to proceed.

Would you like to prepare the F24 update, first?

Kamil, are you still willing to make the patch for the nss.rpm package?
(Or does comment 14 mean that you want Elio to do that work?)

Comment 16 Kamil Dudka 2016-07-20 10:36:55 UTC
Sure.  I will prepare the nss-pem builds and the related nss commits shortly.

Comment 17 Kamil Dudka 2016-07-20 11:24:45 UTC
Created attachment 1182056 [details]
dist-git commit for f24

Please use 'git am'.

Comment 18 Kamil Dudka 2016-07-20 11:25:19 UTC
Created attachment 1182057 [details]
dist-git commits for f23

Please use 'git am'.

Comment 19 Kamil Dudka 2016-07-20 11:28:09 UTC
I have prepared builds of f24/f23 nss-pem with the correct Conflicts tag:

http://koji.fedoraproject.org/koji/buildinfo?buildID=784114
http://koji.fedoraproject.org/koji/buildinfo?buildID=784115

Please make sure that nss and nss-pem go out in a single update batch in Bodhi.

Comment 20 Kamil Dudka 2016-07-20 11:31:34 UTC
Please include the Fedora review bug for nss-pem bug (bug #1346806) into the updates, so that it is closed automatically by Bodhi when it becomes stable.

Comment 21 Kai Engert (:kaie) (inactive account) 2016-07-20 11:37:02 UTC
Kamil, thanks for the patches. I propose we do Fedora 24 first, and see how it goes, and only after it's stable proceed with Fedora 23. This will give us testing with stable users, and this timing will avoid trouble with users upgrading from f23 to f24.

Can we request in bodhi that a single update is used for both nss and nss-pem packages? (To ensure that the timing for both will be identical.)

What about packages that use the pem library as of today, and get it automatically, because we always install nss.rpm?

How do we ensure that users upgrading to the nss-without-pem will also get the nss-pem package automatically?

For example, does curl have a dependency on the pem library, that will cause the system to fetch the new nss-pem package automatically?

We should ensure and test that works, prior to going to updates-testing.

Comment 22 Kai Engert (:kaie) (inactive account) 2016-07-20 11:38:16 UTC
Added Hubert to CC, please see my concerns from comment 21, in case you have any comments on that. Thanks!

Comment 23 Kamil Dudka 2016-07-20 12:17:30 UTC
(In reply to Kai Engert (:kaie) from comment #21)
> Kamil, thanks for the patches. I propose we do Fedora 24 first, and see how
> it goes, and only after it's stable proceed with Fedora 23. This will give
> us testing with stable users, and this timing will avoid trouble with users
> upgrading from f23 to f24.

The updates are prepared such that there is clean f23 -> f24 update path.  You only need to make sure that the f24 update is pushed sooner than the f23 one.  However, you need to do that anyway because of the nss rebase.

If you want to postpone resolution of this bug in f23, I am fine with that.  Just let me know when you are ready.  I will rebase the f23 commits as needed.

> Can we request in bodhi that a single update is used for both nss and
> nss-pem packages? (To ensure that the timing for both will be identical.)

Sure.  That is what comment #19 intended to say :-)  It should be as easy as adding both builds to a single update submission.  If any special privilege is needed for it, I can ask a fellow proven packager to help with the submission.

> What about packages that use the pem library as of today, and get it
> automatically, because we always install nss.rpm?
> 
> How do we ensure that users upgrading to the nss-without-pem will also get
> the nss-pem package automatically?

That is exactly what the 'Requires: nss-pem' is for.  See the comment above the line in nss.spec.  It is already proven to work in Fedora rawhide.

> For example, does curl have a dependency on the pem library,

Not yet.  But there is a long term plan to require nss-pem explicitly by rpm packages that use it.  The above mentioned comment should explain it already.

> that will cause the system to fetch the new nss-pem package automatically?

Just the update of nss will do the job.  No change to curl is required atm.

> We should ensure and test that works, prior to going to updates-testing.

I would not submit the patches without testing them first ;-)

Comment 24 Kai Engert (:kaie) (inactive account) 2016-07-20 12:31:15 UTC
(In reply to Kamil Dudka from comment #23)
> > What about packages that use the pem library as of today, and get it
> > automatically, because we always install nss.rpm?
> > 
> > How do we ensure that users upgrading to the nss-without-pem will also get
> > the nss-pem package automatically?
> 
> That is exactly what the 'Requires: nss-pem' is for.  See the comment above
> the line in nss.spec.  It is already proven to work in Fedora rawhide.

Thank you, that's the detail that I missed.

So NSS always requires nss-pem, and therefore it's ensured that it's always installed. Good.

Comment 25 Kai Engert (:kaie) (inactive account) 2016-07-21 08:07:07 UTC
Kamil, thank you for the patches.

I've built NSS with your patch for Fedora 24, the build is here:
http://koji.fedoraproject.org/koji/taskinfo?taskID=14957982

I've tried to submit an update, but it was rejected, because I don't have commit access to nss-pem.

Can you submit the update?

I have used the following information:

builds:
- nss-pem-1.0.2-2.fc24 
- nss-3.25.0-1.2.fc24 

bugs:
- 1347336
- 1346806

update notes:
This updates moves library libnsspem.so, which was previously shipped as part of the nss package, to a new package nss-pem.

type: newpackage
close bugs on stable

I wonder if we should ask for a bit more testing than usual.
Should we rely on auto-request stable, or should we confirm stable manually?

If auto-stable, maybe require stable karma of 5 ?

Please review the above and submit the update yourself, or alternatively, if you want me to submit the update, you could give me the necessary nss-pem commit access (up to you, but I probably won't work on nss-pem).

Thanks

Comment 26 Kai Engert (:kaie) (inactive account) 2016-07-21 08:08:14 UTC
Assigning the bug to Kamil, because he's doing all the hard work.
I'm just helping with trivial tasks.

Comment 27 Fedora Update System 2016-07-21 08:23:33 UTC
nss-pem-1.0.2-2.fc24 nss-3.25.0-1.2.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-5ac25856f0

Comment 28 Fedora Update System 2016-07-21 18:52:33 UTC
nss-3.25.0-1.2.fc24, nss-pem-1.0.2-2.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-5ac25856f0

Comment 29 Fedora Update System 2016-07-24 20:20:13 UTC
nss-3.25.0-1.2.fc24, nss-pem-1.0.2-2.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 30 Kamil Dudka 2016-07-27 11:18:50 UTC
The f24 update seems to be stable.  Please let me know when you are ready to submit the update for f23.

Comment 31 Fedora Update System 2016-08-01 20:21:13 UTC
nss-3.25.0-1.2.fc23 nss-pem-1.0.2-2.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-87e128568d

Comment 32 Fedora Update System 2016-08-02 21:52:40 UTC
nss-3.25.0-1.2.fc23, nss-pem-1.0.2-2.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-87e128568d

Comment 33 Fedora Update System 2016-08-18 00:50:53 UTC
nss-3.25.0-1.2.fc23, nss-pem-1.0.2-2.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.