Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1422046 - building nss-softokn prefers headers from nss-softokn-*devel, should prefer from build tree
Summary: building nss-softokn prefers headers from nss-softokn-*devel, should prefer f...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: nss-softokn
Version: 26
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: nss-nspr-maint
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-02-14 11:17 UTC by Kai Engert (:kaie) (inactive account)
Modified: 2017-10-14 23:50 UTC (History)
6 users (show)

Fixed In Version: nss-softokn-3.33.0-1.0.fc26
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1489380 (view as bug list)
Environment:
Last Closed: 2017-10-14 23:50:55 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1489380 0 unspecified CLOSED building nss prefers headers from nss-*devel, should prefer from build tree 2022-05-16 11:32:56 UTC

Internal Links: 1489380

Description Kai Engert (:kaie) (inactive account) 2017-02-14 11:17:03 UTC 
I'm filing this bug against nss-softokn, bug we might have the same issue with the other nspr/nss packages, too.

I was trying to locally build nss-softokn with an experimental upstream patch.

I got an error that a function is undefined, but the relevant header was included, and the symbol should have been known.

I looked at preprocessor output (gcc -E), and saw that our build setup has a bug. When building nss-softokn, the globally installed header files from /usr/include/nss3/ were used.


I got this command:

cd fipstest; /usr/bin/make libs
make[2]: Entering directory '/home/kengert/git.fedora/nss-softokn/f25/nss-softokn-3.28.1/nss/cmd/fipstest'
cc -o Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC -DLINUX2_1 -m64 -pipe -ffunction-sections -fdata-sections -DLINUX -Dlinux -DHAVE_STRERROR -Wall -Werror -DXP_UNIX -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_STATIC_LIBS -I/usr/include/nspr4 -I/usr/include/nss3 -I/usr/include/nspr4 -I../../../dist/Linux4.9_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c


The build scripts should be changed, to give the header files from the local build the highest priority. To do so, we must ensure that the -I/usr/... parameters go after other -I parameters, correct?


This probably isn't a problem with our koji/brew builds, because when building nss-softokn, we probably don't have nss-softokn*-devel headers installed. However, if possible we should fix this bug in all nspr/nss packages, to ensure proper behavior when executing local builds.
Comment 1 Fedora End Of Life 2017-02-28 11:17:07 UTC 
This bug appears to have been reported against 'rawhide' during the Fedora 26 development cycle.
Changing version to '26'.
Comment 2 Kamil Dudka 2017-04-20 12:25:15 UTC 
The same happens with nss and nss-devel of incompatible versions.
Comment 3 Kai Engert (:kaie) (inactive account) 2017-04-20 12:32:01 UTC 
Daiki, is this something you could try to fix?
Comment 4 Elio Maldonado Batiz 2017-04-20 15:12:49 UTC 
The following info scattered as comments in the spec files is relevant.

In our spec files we take advantage of the gcc-iquote dir option documented at
http://gcc.gnu.org/onlinedocs/gcc/Directory-Options.html#Directory-Options
to place the in-tree directories at the head of the list of directories
to be searched for for header files. This ensures a build even when system
headers are older. Such is the case when starting an update with API changes or even private export changes. Once the buildroot has been bootstrapped the patch may be removed but it doesn't hurt to keep it.

I should mention that Bob is of the opinion that we should enable the iquote.patch always.

see 
http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n71
http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n132
http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n193

In nss.spec see
http://pkgs.fedoraproject.org/cgit/rpms/nss.git/tree/nss.spec#n102
http://pkgs.fedoraproject.org/cgit/rpms/nss.git/tree/nss.spec#n195
http://pkgs.fedoraproject.org/cgit/rpms/nss-softokn.git/tree/nss-softokn.spec#n193

nss-util.spec doesn't have it.

This is for nss headers only and does not address the case when npsr is the one that brings changes.
Comment 5 Elio Maldonado Batiz 2017-04-20 15:25:47 UTC 
(In reply to Elio Maldonado Batiz from comment #4)
> nss-util.spec doesn't have it.

And now I think it should. I have seen cases where new API's and constants where introduced in headers from util.
Comment 6 Daiki Ueno 2017-08-30 13:46:15 UTC 
Thank you for the explanation, Elio.  So I guess the problem is the -iquote option is enabled in only specific subdirs (cmd/bltest and lib/softoken):
http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/f27/f/iquote.patch

Are there any harm to enable it globally?  I have done that in rawhide as:
http://pkgs.fedoraproject.org/rpms/nss-softokn/blob/master/f/iquote.patch
and the build succeeds:
https://koji.fedoraproject.org/koji/taskinfo?taskID=21553242

Now fipstest is compiled with:
cc -o Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/fipstest.o -c -O2 -fPIC  -m64 -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -DLINUX -Dlinux -Wall -Werror -DXP_UNIX -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSOFTOKEN_LIB_NAME=\"libsoftokn3.so\" -DSHLIB_VERSION=\"3\" -UDEBUG -DNDEBUG -D_REENTRANT -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I/usr/include/nspr4  -I/usr/include/nss3 -I/usr/include/nspr4  -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../public/nss -iquote ../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/../private/nss -I../../../dist/Linux4.11_x86_64_cc_glibc_PTH_64_OPT.OBJ/include -I../../../dist/public/nss -I../../../dist/private/nss -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic fipstest.c

Note that the position of the -iquote option does not matter, as it's always preferred over -I for the quoted forms of #include.
Comment 7 Kamil Dudka 2017-08-30 14:03:28 UTC 
Thanks!  Does this bug need to be cloned for nss or is it easy enough to be fixed without the additional bureaucracy?
Comment 8 Kamil Dudka 2017-09-07 10:20:36 UTC 
(In reply to Kamil Dudka from comment #7)
> Thanks!  Does this bug need to be cloned for nss or is it easy enough to be
> fixed without the additional bureaucracy?

No response for a week.  Cloning now...
Comment 9 Fedora Update System 2017-10-06 05:12:40 UTC 
nss-3.33.0-1.0.fc26 nss-softokn-3.33.0-1.0.fc26 nss-util-3.33.0-1.0.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-621c36fcb8
Comment 10 Fedora Update System 2017-10-14 23:50:55 UTC 
nss-3.33.0-1.0.fc26, nss-softokn-3.33.0-1.0.fc26, nss-util-3.33.0-1.0.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.