This bug appears to have been reported against 'rawhide' during the Fedora 22 development cycle.
Changing version to '22'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora22

Fixed in what version?

Searching through the history I find that pkcs1sig-include-prtypes.patch, which solved this, was introduced in nss-util-3.17.1-1.fc22.

That patch does nothing to fix this bug.  This bug still exists in nss-util-3.20.1-1.0.fc23.

hasht.h must include prtypes.h.

Patch2 in the spec (hasht-dont-include-prtypes.patch) should not be included.

(In reply to Andrew Schultz from comment #4)
> That patch does nothing to fix this bug.  This bug still exists in
> nss-util-3.20.1-1.0.fc23.

Now I remember, that patch is actually there to compensate for for hasht.t not including prtypes.h, for why see below.

> hasht.h must include prtypes.h.
> 
> Patch2 in the spec (hasht-dont-include-prtypes.patch) should not be included.

The reason for this was because it broke the glibc build. For details please see https://bugzilla.redhat.com/show_bug.cgi?id=953277 and see also a related upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1093069

(In reply to Elio Maldonado Batiz from comment #5)
> Now I remember, that patch is actually there to compensate for for hasht.t
> not including prtypes.h, for why see below.

That patch helps build nss-util, but does nothing to help anything else that might want to include hasht.

> The reason for this was because it broke the glibc build. For details please
> see https://bugzilla.redhat.com/show_bug.cgi?id=953277 and see also a
> related upstream bug https://bugzilla.mozilla.org/show_bug.cgi?id=1093069

Unfortunately, I can't see the RH bug.

So, Fedora breaks nss-util on purpose (hasht is completely wrong) for at least a year because of a bug in glibc?  A bug in gcc?  Is there an upstream glibc bug?

The reporter made the RH bug blocked. It doesn't say all that much after all. Upstream one has it, The last sentence in https://bugzilla.mozilla.org/show_bug.cgi?id=1093069#c10 has it. Is that weird dependency dependency the glibc minihash library nas on nss-softoken-freebl because of FIPS=140 validation. If needed Bob Relyea can explain the gory details better than I can. I don't think we can do much about it, but I could be wrong.  No, there is no bug for upstream glibc. Several glibc maintainers are now the CC list.

This is getting ridiculous.  Of course it's a bug.  Nothing has changed since I first reported it.

If glibc devs haven't done anything to fix glibc (and I have no idea if they have because the glibc bug is still closed) then fine, but hasht.h as shipped by nss-util-devel is still completely broken.

This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

This message is a reminder that Fedora 23 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 23. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '23'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 23 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

still a problem with f25

If you're asking for an upstream fix, it should have be requested upstream.

Could you just file a bug at bugzilla.mozilla.org component nss?

Could you just attach the trivial fix that works for you, and ask kaie for review upstream?

Thanks

The problem here is confined the the .spec file.  Upstream ships a perfectly happy release.  The only thing needed here is to drop a patch (from the spec) that causes hasht.h to be broken only in fedora.

(In reply to Andrew Schultz from comment #13)
> The problem here is confined the the .spec file.  Upstream ships a perfectly
> happy release.  The only thing needed here is to drop a patch (from the
> spec) that causes hasht.h to be broken only in fedora.

Yes, actually 2 downstream patches from the rpm should be dropped:

Patch2: hasht-dont-include-prtypes.patch
Patch3: pkcs1sig-include-prtypes.patch

Both of these are an incorrect fix for the original issue (bug 953277 - rawhide build of glibc fails due to fatal error from nss3/hasht.h) The glibc build needs to learn to add -I/usr/include/nspr4 to CFLAGS instead.

This is little bit complicated by the thing that nss-config --includedir cannot return two directories. Thus glibc build must call also nspr-config --includedir. On the other hand nss-config --cflags could be fixed to properly return -I/usr/include/nss3 -I/usr/include/nspr4 and if glibc used it instead of nss-config --includedir, it would work as well.

This breaks build of poppler 0.59.0 now. TBH, I find it hard to believe that such thing could be left rotting for 2 years (and even closed as NOTABUG at one point!)

(In reply to Tomas Mraz from comment #14)
> Yes, actually 2 downstream patches from the rpm should be dropped:
> 
> Patch2: hasht-dont-include-prtypes.patch
> Patch3: pkcs1sig-include-prtypes.patch
> 
> Both of these are an incorrect fix for the original issue (bug 953277 -
> rawhide build of glibc fails due to fatal error from nss3/hasht.h) The glibc
> build needs to learn to add -I/usr/include/nspr4 to CFLAGS instead.

OK, let's drop them in the next build:
http://pkgs.fedoraproject.org/cgit/rpms/nss-util.git/commit/?id=b3b2d6022e4d9fa7daddf02da5029606d1e46686

> This is little bit complicated by the thing that nss-config --includedir
> cannot return two directories. Thus glibc build must call also nspr-config
> --includedir. On the other hand nss-config --cflags could be fixed to
> properly return -I/usr/include/nss3 -I/usr/include/nspr4 and if glibc used
> it instead of nss-config --includedir, it would work as well.

I would suggest the former approach (or using pkg-config) for the meantime, because this is part of glibc upstream and there could be a time lag until the fixed nss-config is deployed.  Also it seems a further adjustment is needed as glibc redefines PRBool as a different type (int, not unsigned int).

(In reply to Daiki Ueno from comment #16)

> Also it seems a further adjustment is
> needed as glibc redefines PRBool as a different type (int, not unsigned int).

Disregard this, it was my misunderstanding.

This message is a reminder that Fedora 25 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 25. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '25'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 25 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

This was fixed in rawhide back in September (comment 16) with version 3.32.0-3, but is not included with f26 or f27 builds.

This message is a reminder that Fedora 26 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 26. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as EOL if it remains open with a Fedora  'version'
of '26'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version'
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not
able to fix it before Fedora 26 is end of life. If you would still like
to see this bug fixed and are able to reproduce it against a later version
of Fedora, you are encouraged  change the 'version' to a later Fedora
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

I'll take care of fixing this per comment #19 , holler if there are any objections.

It may not be obvious, but I'm doing this on behalf of poppler (and poppler upstream) where this modification can break builds.

I'll verify no glibc badness happens too (otherwise we may have to live with it), per https://bugzilla.redhat.com/show_bug.cgi?id=1489339#c1
with the rationale why this wasn't backported (yet):

"I have built the nss-util package in rawhide, with this change (nss-util-3.33.0-2.fc28).  I don't plan to port it to other branches so far, but please be aware of the possible FTBFS in rawhide."

fyi, pull request for f27:
https://src.fedoraproject.org/rpms/nss-util/pull-request/2


f26 would require extra work (fixing glibc), probably not worth doing this close to EOL

Daiki, could you please comment on this request?

Thank you, Rex.  As it sounds safe, I have merged the pull request.

nss-3.37.3-1.0.fc27 nss-softokn-3.37.3-1.0.fc27 nss-util-3.37.3-1.0.fc27 has been submitted as an update to Fedora 27. https://bodhi.fedoraproject.org/updates/FEDORA-2018-abcf8713de

nss-3.37.3-1.0.fc27, nss-softokn-3.37.3-1.0.fc27, nss-util-3.37.3-1.0.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2018-abcf8713de

nss-3.37.3-1.0.fc27, nss-softokn-3.37.3-1.0.fc27, nss-util-3.37.3-1.0.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.