Hi, On Sat, 3 Nov 2018 11:28:26 -0600 Brian Woodcox wrote: > I’m getting a build failure when building nss-3.36.1. > > I have the entire log. Here is the end part of it. > > Any ideas? This package does not build reproducibly. At least in the long term: There are tests that check certificates on temporal validity and that depends on the system time. I can reproduce your result with the 3.39 version. It looks like one certificate is expired. All 6 failing tests look about like this one: s -d AllDB -pp - PASSED chains.sh: Verifying certificate(s) PayPalEE.cert with flags -d AllDB -pp -o OID.2.16.840.1.114412.1.1 vfychain -d AllDB -pp -vv -o OID.2.16.840.1.114412.1.1 /tmp/guix-build-nss -3.39.drv-0/nss-3.39/nss/tests/libpkix/certs/PayPalEE.cert Chain is bad! PROBLEM WITH THE CERT CHAIN: CERT 0. PayPalEE : ERROR -8181: Peer's Certificate has expired. Returned value is 1, expected result is pass chains.sh: #1555: RealCerts: Verifying certificate(s) PayPalEE.cert with flags -d AllDB -pp -o OID.2.16.840.1.114412.1.1 - FAILED I don't know how to check the expiration date of PayPalEE.cert. It looks like upstream has not yet worked on it, as the file was lastly modified two years ago: https://hg.mozilla.org/projects/nss/log/tip/tests/libpkix/certs/PayPalEE.cert Cmp also this bug that demands non-expiration certificates: https://bugzilla.mozilla.org/show_bug.cgi?id=1330010 Building 3.40 does not work with just updating version/hashsum. A quick solution would be to build nss from a Guix git-checkout and disable tests. Björn