/usr/bin/certutil and other programs in nss-tools-3.35.0-4.fc28.x86_64 are not linked with the standard LDFLAGS from redhat-rpm-config. More information about RPM macros to set CFLAGS and LDFLAGS is available here: https://src.fedoraproject.org/rpms/redhat-rpm-config/blob/master/f/buildflags.md
This bug appears to have been reported against 'rawhide' during the Fedora 28 development cycle. Changing version to '28'.
I simply added "LDFLAGS=$RPM_LD_FLAGS; export LDFLAGS" in the spec: https://src.fedoraproject.org/rpms/nss/c/03874d12724f28a6df4d78e48d8315a6d8e423dc?branch=master and the build seems to pick up the correct flags: https://koji.fedoraproject.org/koji/taskinfo?taskID=25659474 This might be suboptimal; maybe we could: - respect $LDFLAGS already set in the shell environment - introduce a separate make variable, e.g., XLDFLAGS analogous to XCFLAGS
This should be fixed in the current update of the nss package. Feel free to reopen if it is not the case.