Re: Build failure on nss-3.36.1

["Björn Höfling" <bjoern.hoefling@bjoernhoefling.de>]

[-- Attachment #1: Type: text/plain, Size: 1657 bytes --]

Hi,

On Sat, 3 Nov 2018 11:28:26 -0600
Brian Woodcox <bw@inskydata.com> wrote:

> I’m getting a build failure when building nss-3.36.1.
> 
> I have the entire log.  Here is the end part of it.
> 
> Any ideas?

This package does not build reproducibly. At least in the long term:
There are tests that check certificates on temporal validity and that
depends on the system time.

I can reproduce your result with the 3.39 version. It looks like one
certificate is expired. All 6 failing tests look about like this one:


s -d AllDB -pp       - PASSED
chains.sh: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      
-o OID.2.16.840.1.114412.1.1 
vfychain -d AllDB -pp -vv      -o OID.2.16.840.1.114412.1.1  /tmp/guix-build-nss
-3.39.drv-0/nss-3.39/nss/tests/libpkix/certs/PayPalEE.cert 
Chain is bad!
PROBLEM WITH THE CERT CHAIN:
CERT 0. PayPalEE :
  ERROR -8181: Peer's Certificate has expired.
Returned value is 1, expected result is pass
chains.sh: #1555: RealCerts: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      -o OID.2.16.840.1.114412.1.1  - FAILED


I don't know how to check the expiration date of PayPalEE.cert.

It looks like upstream has not yet worked on it, as the file was lastly
modified two years ago:

https://hg.mozilla.org/projects/nss/log/tip/tests/libpkix/certs/PayPalEE.cert

Cmp also this bug that demands non-expiration certificates:

https://bugzilla.mozilla.org/show_bug.cgi?id=1330010

Building 3.40 does not work with just updating version/hashsum.

A quick solution would be to build nss from a Guix git-checkout and
disable tests.

Björn

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]