+++ This bug was initially created as a clone of Bug #1422046 +++ I'm filing this bug against nss-softokn, bug we might have the same issue with the other nspr/nss packages, too. I was trying to locally build nss-softokn with an experimental upstream patch. I got an error that a function is undefined, but the relevant header was included, and the symbol should have been known. I looked at preprocessor output (gcc -E), and saw that our build setup has a bug. When building nss-softokn, the globally installed header files from /usr/include/nss3/ were used. I got this command: cd fipstest; /usr/bin/make libs make[2]: Entering directory '/home/kengert/git.fedora/nss-softokn/f25/nss-softokn-3.28.1/nss/cmd/fipstest' cc -o Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -DLINUX2_1 -m64 -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR -Wall -Werror -DXP_UNIX -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_STATIC_LIBS -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -I../../../dist/Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c The build scripts should be changed, to give the header files from the local build the highest priority. To do so, we must ensure that the -I/usr/... parameters go after other -I parameters, correct? This probably isn't a problem with our koji/brew builds, because when building nss-softokn, we probably don't have nss-softokn*-devel headers installed. However, if possible we should fix this bug in all nspr/nss packages, to ensure proper behavior when executing local builds. --- Additional comment from Kamil Dudka on 2017-04-20 14:25:15 CEST --- The same happens with nss and nss-devel of incompatible versions. --- Additional comment from Daiki Ueno on 2017-08-30 15:46:15 CEST --- Thank you for the explanation, Elio. So I guess the problem is the -iquote option is enabled in only specific subdirs (cmd/bltest and lib/softoken): http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/f27/f/iquote.patch Are there any harm to enable it globally? I have done that in rawhide as: http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/master/f/iquote.patch and the build succeeds: https://koji.fedoraproject.org/koji/taskinfo?taskID=21553242 Now fipstest is compiled with: cc -o Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -m64 -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSOFTOKEN_LIB_NAME=\"libsoftokn3.so\" -DSHLIB_VERSION=\"3\" -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../private/nss -I../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c Note that the position of the -iquote option does not matter, as it's always preferred over -I for the quoted forms of #include. --- Additional comment from Kamil Dudka on 2017-08-30 16:03:28 CEST --- Thanks! Does this bug need to be cloned for nss or is it easy enough to be fixed without the additional bureaucracy? --- Additional comment from Kamil Dudka on 2017-09-07 12:20:36 CEST --- (In reply to Kamil Dudka from comment #7) > Thanks! Does this bug need to be cloned for nss or is it easy enough to be > fixed without the additional bureaucracy? No response for a week. Cloning now...
Thank you for reminding, pushed it as: http://pkgs.fedoraproject.org/cgit/rpms/nss.git/commit/?id=3e4febd5a1cc207b154d930b50d0aa5d8e0358fd Now building in rawhide.
Thank you Daiki and Kamil, this is the proper way to go. The iquote.patch being now globally applied is now simple and clear and we don't have to be adjusting it with various rebases. As per the comment, and Bob's opinion, it can be left active all the time.
nss-3.33.0-1.0.fc26 nss-softokn-3.33.0-1.0.fc26 nss-util-3.33.0-1.0.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-621c36fcb8
nss-3.33.0-1.0.fc26, nss-softokn-3.33.0-1.0.fc26, nss-util-3.33.0-1.0.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.