Bug 1489380

+++ This bug was initially created as a clone of Bug #1422046 +++

I'm filing this bug against nss-softokn, bug we might have the same issue with the other nspr/nss packages, too.

I was trying to locally build nss-softokn with an experimental upstream patch.

I got an error that a function is undefined, but the relevant header was included, and the symbol should have been known.

I looked at preprocessor output (gcc -E), and saw that our build setup has a bug. When building nss-softokn, the globally installed header files from /usr/include/nss3/ were used.


I got this command:

cd fipstest; /usr/bin/make libs
make[2]: Entering directory '/home/kengert/git.fedora/nss-softokn/f25/nss-softokn-3.28.1/nss/cmd/fipstest'
cc -o Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -DLINUX2_1 -m64 -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR -Wall -Werror -DXP_UNIX -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_STATIC_LIBS -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -I../../../dist/Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c


The build scripts should be changed, to give the header files from the local build the highest priority. To do so, we must ensure that the -I/usr/... parameters go after other -I parameters, correct?


This probably isn't a problem with our koji/brew builds, because when building nss-softokn, we probably don't have nss-softokn*-devel headers installed. However, if possible we should fix this bug in all nspr/nss packages, to ensure proper behavior when executing local builds.

--- Additional comment from Kamil Dudka on 2017-04-20 14:25:15 CEST ---

The same happens with nss and nss-devel of incompatible versions.

--- Additional comment from Daiki Ueno on 2017-08-30 15:46:15 CEST ---

Thank you for the explanation, Elio.  So I guess the problem is the -iquote option is enabled in only specific subdirs (cmd/bltest and lib/softoken):
http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/f27/f/iquote.patch

Are there any harm to enable it globally?  I have done that in rawhide as:
http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/master/f/iquote.patch
and the build succeeds:
https://koji.fedoraproject.org/koji/taskinfo?taskID=21553242

Now fipstest is compiled with:
cc -o Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC  -m64 -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSOFTOKEN_LIB_NAME=\"libsoftokn3.so\" -DSHLIB_VERSION=\"3\" -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I/usr/include/nspr4  -I/usr/include/nss3 -I/usr/include/nspr4  -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../private/nss -I../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c

Note that the position of the -iquote option does not matter, as it's always preferred over -I for the quoted forms of #include.

--- Additional comment from Kamil Dudka on 2017-08-30 16:03:28 CEST ---

Thanks!  Does this bug need to be cloned for nss or is it easy enough to be fixed without the additional bureaucracy?

--- Additional comment from Kamil Dudka on 2017-09-07 12:20:36 CEST ---

(In reply to Kamil Dudka from comment #7)
> Thanks!  Does this bug need to be cloned for nss or is it easy enough to be
> fixed without the additional bureaucracy?

No response for a week.  Cloning now...