Bug 1422046 - building nss-softokn prefers headers from nss-softokn-*devel, should prefer from build tree
Summary: building nss-softokn prefers headers from nss-softokn-*devel, should prefer f...
Alias: None
Product: Fedora
Classification: Fedora
Component: nss-softokn
Version: 26
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: nss-nspr-maint
QA Contact: Fedora Extras Quality Assurance
Depends On:
TreeView+ depends on / blocked
Reported: 2017-02-14 11:17 UTC by Kai Engert (:kaie) (inactive account)
Modified: 2017-10-14 23:50 UTC (History)
6 users (show)

Fixed In Version: nss-softokn-3.33.0-1.0.fc26
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1489380 (view as bug list)
Last Closed: 2017-10-14 23:50:55 UTC
Type: Bug

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1489380 0 unspecified CLOSED building nss prefers headers from nss-*devel, should prefer from build tree 2021-02-22 00:41:40 UTC

Internal Links: 1489380

Description Kai Engert (:kaie) (inactive account) 2017-02-14 11:17:03 UTC
I'm filing this bug against nss-softokn, bug we might have the same issue with the other nspr/nss packages, too.

I was trying to locally build nss-softokn with an experimental upstream patch.

I got an error that a function is undefined, but the relevant header was included, and the symbol should have been known.

I looked at preprocessor output (gcc -E), and saw that our build setup has a bug. When building nss-softokn, the globally installed header files from /usr/include/nss3/ were used.

I got this command:

cd fipstest; /usr/bin/make libs
make[2]: Entering directory '/home/kengert/git.fedora/nss-softokn/f25/nss-softokn-3.28.1/nss/cmd/fipstest'
cc -o Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -DLINUX2_1 -m64 -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR -Wall -Werror -DXP_UNIX -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_STATIC_LIBS -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -I../../../dist/Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c

The build scripts should be changed, to give the header files from the local build the highest priority. To do so, we must ensure that the -I/usr/... parameters go after other -I parameters, correct?

This probably isn't a problem with our koji/brew builds, because when building nss-softokn, we probably don't have nss-softokn*-devel headers installed. However, if possible we should fix this bug in all nspr/nss packages, to ensure proper behavior when executing local builds.

Comment 1 Fedora End Of Life 2017-02-28 11:17:07 UTC
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.

Comment 2 Kamil Dudka 2017-04-20 12:25:15 UTC
The same happens with nss and nss-devel of incompatible versions.

Comment 3 Kai Engert (:kaie) (inactive account) 2017-04-20 12:32:01 UTC
Daiki, is this something you could try to fix?

Comment 4 Elio Maldonado Batiz 2017-04-20 15:12:49 UTC
The following info scattered as comments in the spec files is relevant.

In our spec files we take advantage of the gcc-iquote dir option documented at
to place the in-tree directories at the head of the list of directories
to be searched for for header files. This ensures a build even when system
headers are older. Such is the case when starting an update with API changes or even private export changes. Once the buildroot has been bootstrapped the patch may be removed but it doesn't hurt to keep it.

I should mention that Bob is of the opinion that we should enable the iquote.patch always.


In nss.spec see

nss-util.spec doesn't have it.

This is for nss headers only and does not address the case when npsr is the one that brings changes.

Comment 5 Elio Maldonado Batiz 2017-04-20 15:25:47 UTC
(In reply to Elio Maldonado Batiz from comment #4)
> nss-util.spec doesn't have it.

And now I think it should. I have seen cases where new API's and constants where introduced in headers from util.

Comment 6 Daiki Ueno 2017-08-30 13:46:15 UTC
Thank you for the explanation, Elio.  So I guess the problem is the -iquote option is enabled in only specific subdirs (cmd/bltest and lib/softoken):

Are there any harm to enable it globally?  I have done that in rawhide as:
and the build succeeds:

Now fipstest is compiled with:
cc -o Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC  -m64 -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSOFTOKEN_LIB_NAME=\"libsoftokn3.so\" -DSHLIB_VERSION=\"3\" -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I/usr/include/nspr4  -I/usr/include/nss3 -I/usr/include/nspr4  -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../private/nss -I../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c

Note that the position of the -iquote option does not matter, as it's always preferred over -I for the quoted forms of #include.

Comment 7 Kamil Dudka 2017-08-30 14:03:28 UTC
Thanks!  Does this bug need to be cloned for nss or is it easy enough to be fixed without the additional bureaucracy?

Comment 8 Kamil Dudka 2017-09-07 10:20:36 UTC
(In reply to Kamil Dudka from comment #7)
> Thanks!  Does this bug need to be cloned for nss or is it easy enough to be
> fixed without the additional bureaucracy?

No response for a week.  Cloning now...

Comment 9 Fedora Update System 2017-10-06 05:12:40 UTC
nss-3.33.0-1.0.fc26 nss-softokn-3.33.0-1.0.fc26 nss-util-3.33.0-1.0.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-621c36fcb8

Comment 10 Fedora Update System 2017-10-14 23:50:55 UTC
nss-3.33.0-1.0.fc26, nss-softokn-3.33.0-1.0.fc26, nss-util-3.33.0-1.0.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.