I'm filing this bug against nss-softokn, bug we might have the same issue with the other nspr/nss packages, too. I was trying to locally build nss-softokn with an experimental upstream patch. I got an error that a function is undefined, but the relevant header was included, and the symbol should have been known. I looked at preprocessor output (gcc -E), and saw that our build setup has a bug. When building nss-softokn, the globally installed header files from /usr/include/nss3/ were used. I got this command: cd fipstest; /usr/bin/make libs make[2]: Entering directory '/home/kengert/git.fedora/nss-softokn/f25/nss-softokn-3.28.1/nss/cmd/fipstest' cc -o Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -DLINUX2_1 -m64 -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR -Wall -Werror -DXP_UNIX -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_STATIC_LIBS -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -I../../../dist/Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c The build scripts should be changed, to give the header files from the local build the highest priority. To do so, we must ensure that the -I/usr/... parameters go after other -I parameters, correct? This probably isn't a problem with our koji/brew builds, because when building nss-softokn, we probably don't have nss-softokn*-devel headers installed. However, if possible we should fix this bug in all nspr/nss packages, to ensure proper behavior when executing local builds.
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle. Changing version to '26'.
The same happens with nss and nss-devel of incompatible versions.
Daiki, is this something you could try to fix?
The following info scattered as comments in the spec files is relevant. In our spec files we take advantage of the gcc-iquote dir option documented at http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options to place the in-tree directories at the head of the list of directories to be searched for for header files. This ensures a build even when system headers are older. Such is the case when starting an update with API changes or even private export changes. Once the buildroot has been bootstrapped the patch may be removed but it doesn't hurt to keep it. I should mention that Bob is of the opinion that we should enable the iquote.patch always. see http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n71 http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n132 http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n193 In nss.spec see http://pkgs.fedoraproject.org/cgit/rpms/nss.git/tree/nss.spec#n102 http://pkgs.fedoraproject.org/cgit/rpms/nss.git/tree/nss.spec#n195 http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n193 nss-util.spec doesn't have it. This is for nss headers only and does not address the case when npsr is the one that brings changes.
(In reply to Elio Maldonado Batiz from comment #4) > nss-util.spec doesn't have it. And now I think it should. I have seen cases where new API's and constants where introduced in headers from util.
Thank you for the explanation, Elio. So I guess the problem is the -iquote option is enabled in only specific subdirs (cmd/bltest and lib/softoken): http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/f27/f/iquote.patch Are there any harm to enable it globally? I have done that in rawhide as: http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/master/f/iquote.patch and the build succeeds: https://koji.fedoraproject.org/koji/taskinfo?taskID=21553242 Now fipstest is compiled with: cc -o Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -m64 -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSOFTOKEN_LIB_NAME=\"libsoftokn3.so\" -DSHLIB_VERSION=\"3\" -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../private/nss -I../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c Note that the position of the -iquote option does not matter, as it's always preferred over -I for the quoted forms of #include.
Thanks! Does this bug need to be cloned for nss or is it easy enough to be fixed without the additional bureaucracy?
(In reply to Kamil Dudka from comment #7) > Thanks! Does this bug need to be cloned for nss or is it easy enough to be > fixed without the additional bureaucracy? No response for a week. Cloning now...
nss-3.33.0-1.0.fc26 nss-softokn-3.33.0-1.0.fc26 nss-util-3.33.0-1.0.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-621c36fcb8
nss-3.33.0-1.0.fc26, nss-softokn-3.33.0-1.0.fc26, nss-util-3.33.0-1.0.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.