unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / Atom feed
* bug#33253: nss cannot build
@ 2018-11-04  9:52 Gnu Röoty
  2018-11-04 12:52 ` Quiliro Ordonez
  2018-11-04 16:30 ` Björn Höfling
  0 siblings, 2 replies; 4+ messages in thread
From: Gnu Röoty @ 2018-11-04  9:52 UTC (permalink / raw)
  To: 33253

[-- Attachment #1: Type: text/plain, Size: 98 bytes --]

HI from 2 days I build the installation of guixSD to berlin.guixsd.org and
nss-3.36.6 cant build.

[-- Attachment #2: Type: text/html, Size: 162 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

* bug#33253: nss cannot build
  2018-11-04  9:52 bug#33253: nss cannot build Gnu Röoty
@ 2018-11-04 12:52 ` Quiliro Ordonez
  2018-11-04 16:30 ` Björn Höfling
  1 sibling, 0 replies; 4+ messages in thread
From: Quiliro Ordonez @ 2018-11-04 12:52 UTC (permalink / raw)
  To: 33253

El 2018-11-04 04:52, Gnu Röoty escribió:

> HI from 2 days I build the installation of guixSD to berlin.guixsd.org and nss-3.36.6 cant build.

Errors?
Tested solutions?
Understandings about Guix?

Please provide information so that helping is not so difficult.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* bug#33253: nss cannot build
  2018-11-04  9:52 bug#33253: nss cannot build Gnu Röoty
  2018-11-04 12:52 ` Quiliro Ordonez
@ 2018-11-04 16:30 ` Björn Höfling
  2021-04-03  4:44   ` Maxim Cournoyer
  1 sibling, 1 reply; 4+ messages in thread
From: Björn Höfling @ 2018-11-04 16:30 UTC (permalink / raw)
  To: Gnu Röoty; +Cc: 33253

[-- Attachment #1: Type: text/plain, Size: 1799 bytes --]

On Sun, 4 Nov 2018 09:52:44 +0000
Gnu Röoty <walidslack@gmail.com> wrote:

> HI from 2 days I build the installation of guixSD to
> berlin.guixsd.org and nss-3.36.6 cant build.

This was also reported on guix-help by Brian Woodcox.

Here is some analysis I reported to that thread:

This package does not build reproducibly. At least in the long term:
There are tests that check certificates on temporal validity and that
depends on the system time.

I can reproduce your result with the 3.39 version. It looks like one
certificate is expired. All 6 failing tests look about like this one:


s -d AllDB -pp       - PASSED
chains.sh: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      
-o OID.2.16.840.1.114412.1.1 
vfychain -d AllDB -pp -vv      -o OID.2.16.840.1.114412.1.1  /tmp/guix-build-nss
-3.39.drv-0/nss-3.39/nss/tests/libpkix/certs/PayPalEE.cert 
Chain is bad!
PROBLEM WITH THE CERT CHAIN:
CERT 0. PayPalEE :
  ERROR -8181: Peer's Certificate has expired.
Returned value is 1, expected result is pass
chains.sh: #1555: RealCerts: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      -o OID.2.16.840.1.114412.1.1  - FAILED


I don't know how to check the expiration date of PayPalEE.cert.

It looks like upstream has not yet worked on it, as the file was lastly
modified two years ago:

https://hg.mozilla.org/projects/nss/log/tip/tests/libpkix/certs/PayPalEE.cert

Cmp also this bug that demands non-expiration certificates:

https://bugzilla.mozilla.org/show_bug.cgi?id=1330010

Building 3.40 does not work with just updating version/hashsum.

A quick solution would be to build nss from a Guix git-checkout and
disable tests. But it has many dependencies, so you more or less rebuild the world.


Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

* bug#33253: nss cannot build
  2018-11-04 16:30 ` Björn Höfling
@ 2021-04-03  4:44   ` Maxim Cournoyer
  0 siblings, 0 replies; 4+ messages in thread
From: Maxim Cournoyer @ 2021-04-03  4:44 UTC (permalink / raw)
  To: Björn Höfling; +Cc: 33253-done, Gnu Röoty

Hi,

Björn Höfling <bjoern.hoefling@bjoernhoefling.de> writes:

> On Sun, 4 Nov 2018 09:52:44 +0000
> Gnu Röoty <walidslack@gmail.com> wrote:
>
>> HI from 2 days I build the installation of guixSD to
>> berlin.guixsd.org and nss-3.36.6 cant build.
>
> This was also reported on guix-help by Brian Woodcox.
>
> Here is some analysis I reported to that thread:
>
> This package does not build reproducibly. At least in the long term:
> There are tests that check certificates on temporal validity and that
> depends on the system time.
>
> I can reproduce your result with the 3.39 version. It looks like one
> certificate is expired. All 6 failing tests look about like this one:
>
>
> s -d AllDB -pp       - PASSED
> chains.sh: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      
> -o OID.2.16.840.1.114412.1.1 
> vfychain -d AllDB -pp -vv      -o OID.2.16.840.1.114412.1.1  /tmp/guix-build-nss
> -3.39.drv-0/nss-3.39/nss/tests/libpkix/certs/PayPalEE.cert 
> Chain is bad!
> PROBLEM WITH THE CERT CHAIN:
> CERT 0. PayPalEE :
>   ERROR -8181: Peer's Certificate has expired.
> Returned value is 1, expected result is pass
> chains.sh: #1555: RealCerts: Verifying certificate(s) PayPalEE.cert
> with flags -d AllDB -pp -o OID.2.16.840.1.114412.1.1 - FAILED
>
>
> I don't know how to check the expiration date of PayPalEE.cert.
>
> It looks like upstream has not yet worked on it, as the file was lastly
> modified two years ago:
>
> https://hg.mozilla.org/projects/nss/log/tip/tests/libpkix/certs/PayPalEE.cert
>
> Cmp also this bug that demands non-expiration certificates:
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=1330010
>
> Building 3.40 does not work with just updating version/hashsum.
>
> A quick solution would be to build nss from a Guix git-checkout and
> disable tests. But it has many dependencies, so you more or less rebuild the world.
>
>
> Björn

Since at least Thu Apr 4 15:14:57 2019 +0200, the test dealing with the
problematic PayPalEE.cert certificate is now done after faking the time
to a date around the release date with the 'faketime' utility.

As nss builds fine currently, I'm marking this bug as done.

Thanks for the report!

Maxim




^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-04-03  4:45 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-11-04  9:52 bug#33253: nss cannot build Gnu Röoty
2018-11-04 12:52 ` Quiliro Ordonez
2018-11-04 16:30 ` Björn Höfling
2021-04-03  4:44   ` Maxim Cournoyer

unofficial mirror of bug-guix@gnu.org 

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://yhetil.org/guix-bugs/0 guix-bugs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 guix-bugs guix-bugs/ https://yhetil.org/guix-bugs \
		bug-guix@gnu.org
	public-inbox-index guix-bugs

Example config snippet for mirrors.
Newsgroups are available over NNTP:
	nntp://news.yhetil.org/yhetil.gnu.guix.bugs
	nntp://news.gmane.io/gmane.comp.gnu.guix.bugs


AGPL code for this site: git clone http://ou63pmih66umazou.onion/public-inbox.git