Confirmed.  Any idea how to fix it?

I wonder if patching curl.spec as follows would do the trick:

diff --git a/curl.spec b/curl.spec
index 9e2ab3f..f1bfd1f 100644
--- a/curl.spec
+++ b/curl.spec
@@ -79,17 +79,17 @@ resume, proxy tunneling and a busload of other useful tricks.

 %package -n libcurl
 Summary: A library for getting files from web servers
 Group: Development/Libraries
 Requires: libssh2%{?_isa} >= %{libssh2_version}

 # libnsspem.so is no longer included in the nss package (#1347336)
 BuildRequires: nss-pem
-Requires: nss-pem
+Requires: nss-pem%{?_isa}

 %description -n libcurl
 libcurl is a free and easy-to-use client-side URL transfer library, supporting
 FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
 SMTP, POP3 and RTSP. libcurl supports SSL certificates, HTTP POST, HTTP PUT,
 FTP uploading, HTTP form based upload, proxies, cookies, user+password
 authentication (Basic, Digest, NTLM, Negotiate, Kerberos4), file transfer
 resume, http proxy tunneling and more.

No, patching libcurl.spec is not sufficient, as nss-pem.i686 is simply not available on x86_64. You could verify this with:

   sudo dnf install -y nss-pem.i686

(on a x86_64 box). It is simply not found.

I already verified it (sorry if it was not obvious from my reply) and I believe that the proposed patch for curl.spec would fix this bug by making nss-pem.i686 available on x86_64.  I am not aware of any change to nss-pem.spec itself that could help us to fix this bug.

(In reply to Kamil Dudka from comment #3)
> I already verified it (sorry if it was not obvious from my reply) and I
> believe that the proposed patch for curl.spec would fix this bug by making
> nss-pem.i686 available on x86_64.  I am not aware of any change to
> nss-pem.spec itself that could help us to fix this bug.

Adding an arch-specific dependency will only help once the 32-bit package ends up in the 64-bit repo. To get that to happen, a ticket needs to be raised on pungi-fedora, like this one for postgresql-odbc and mysql-connector-odbc:

https://pagure.io/pungi-fedora/issue/124

I don't know if that affects all releases, or just Rawhide. Best to ask when raising the ticket.

Paul, are you saying that the tool for creating composes of Fedora is so stupid that it does not automatically pull multilib dependencies of packages that are already multilib?

The white-list you refer to contains 18 items for the whole Fedora:

https://pagure.io/fork/mohanboddu/pungi-fedora/blob/cacd6091/f/fedora.conf#_177

I see neither libcurl nor nss on the list.  So why should we append nss-pem?

My understanding is that it includes devel packages, their dependencies and things on the multilib whitelist. I may be wrong and there's no need to do anything except make the change you suggested and get nss-pem 32-bit pulled in via the dependency route - I've never needed to address a multilib issue like this previously.

(In reply to Paul Howarth from comment #6)
> My understanding is that it includes devel packages, their dependencies and
> things on the multilib whitelist.

So it is exactly what we need here, isn't it?

libcurl-devel-7.51.0-4.fc25.i686 requires libcurl(x86-32) = 7.51.0-4.fc25, which is provided by libcurl-7.51.0-4.fc25.i686.  If we make libcurl.i686 require nss-pem(x86-32), nss-pem.i686 will become (indirect) dependency of libcurl-devel.i686.

In any case, adding the suggested dependency to the libcurl package should be harmless.  Even if it did not solve the problem with making nss-pem.i686 available on x86_64, it would at least prevent users from installing libcurl that fails to load certificates from files.  For people that install nss-pem.i686 manually from Koji, it will continue to work as before.

So I propose to introduce the dependency in libcurl first.  If it does not help, I will file the ticket on pungi-fedora.

Sounds like a good plan to me, in Rawhide first as proof of concept of course.

Thanks for review!  Pushed:

http://pkgs.fedoraproject.org/cgit/rpms/curl.git/commit/?id=4832a02c

Appears to be fixed in Fedora rawhide...

[kdudka@f27 ~]$ uname -m 
x86_64

[kdudka@f27 ~]$ sudo dnf install -y libcurl-devel.i686
Last metadata expiration check: 0:08:26 ago on Wed Mar 08 16:09:10 2017 CET.
Dependencies resolved.
================================================================================
 Package               Arch        Version                 Repository      Size
================================================================================
Installing:
 libcurl-devel         i686        7.53.1-3.fc27           rawhide        699 k
Installing dependencies:
 cyrus-sasl-lib        i686        2.1.26-28.fc26          rawhide        163 k
 krb5-libs             i686        1.15.1-1.fc27           rawhide        786 k
 libcom_err            i686        1.43.4-2.fc26           rawhide         45 k
 libcurl               i686        7.53.1-3.fc27           rawhide        288 k
 libdb                 i686        5.3.28-17.fc26          rawhide        801 k
 libidn2               i686        0.16-2.fc26             rawhide         86 k
 libnghttp2            i686        1.20.0-1.fc26           rawhide         76 k
 libpsl                i686        0.17.0-2.fc26           rawhide         48 k
 libunistring          i686        0.9.7-1.fc26            rawhide        416 k
 libverto              i686        0.2.6-7.fc26            rawhide         21 k
 nss-pem               i686        1.0.3-2.fc27            rawhide         79 k
 openldap              i686        2.4.44-8.fc26           rawhide        362 k

Transaction Summary
================================================================================
Install  13 Packages

Total download size: 3.8 M
Installed size: 8.9 M
Downloading Packages:
(1/13): libcurl-7.53.1-3.fc27.i686.rpm           19 MB/s | 288 kB     00:00    
(2/13): libcurl-devel-7.53.1-3.fc27.i686.rpm     28 MB/s | 699 kB     00:00    
(3/13): libcom_err-1.43.4-2.fc26.i686.rpm       4.0 MB/s |  45 kB     00:00    
(4/13): krb5-libs-1.15.1-1.fc27.i686.rpm         22 MB/s | 786 kB     00:00    
(5/13): libidn2-0.16-2.fc26.i686.rpm            7.1 MB/s |  86 kB     00:00    
(6/13): libnghttp2-1.20.0-1.fc26.i686.rpm       6.3 MB/s |  76 kB     00:00    
(7/13): libpsl-0.17.0-2.fc26.i686.rpm           9.0 MB/s |  48 kB     00:00    
(8/13): nss-pem-1.0.3-2.fc27.i686.rpm            11 MB/s |  79 kB     00:00    
(9/13): libverto-0.2.6-7.fc26.i686.rpm          5.0 MB/s |  21 kB     00:00    
(10/13): openldap-2.4.44-8.fc26.i686.rpm         25 MB/s | 362 kB     00:00    
(11/13): cyrus-sasl-lib-2.1.26-28.fc26.i686.rpm  18 MB/s | 163 kB     00:00    
(12/13): libunistring-0.9.7-1.fc26.i686.rpm      26 MB/s | 416 kB     00:00    
(13/13): libdb-5.3.28-17.fc26.i686.rpm           49 MB/s | 801 kB     00:00    
--------------------------------------------------------------------------------
Total                                            50 MB/s | 3.8 MB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Installing  : libunistring-0.9.7-1.fc26.i686                             1/13 
  Installing  : libidn2-0.16-2.fc26.i686                                   2/13 
  Installing  : libcom_err-1.43.4-2.fc26.i686                              3/13 
  Installing  : libpsl-0.17.0-2.fc26.i686                                  4/13 
  Installing  : libdb-5.3.28-17.fc26.i686                                  5/13 
  Installing  : cyrus-sasl-lib-2.1.26-28.fc26.i686                         6/13 
  Installing  : openldap-2.4.44-8.fc26.i686                                7/13 
  Installing  : libverto-0.2.6-7.fc26.i686                                 8/13 
  Installing  : krb5-libs-1.15.1-1.fc27.i686                               9/13 
  Installing  : nss-pem-1.0.3-2.fc27.i686                                 10/13 
  Installing  : libnghttp2-1.20.0-1.fc26.i686                             11/13 
  Installing  : libcurl-7.53.1-3.fc27.i686                                12/13 
  Installing  : libcurl-devel-7.53.1-3.fc27.i686                          13/13 
  Verifying   : libcurl-devel-7.53.1-3.fc27.i686                           1/13 
  Verifying   : libcurl-7.53.1-3.fc27.i686                                 2/13 
  Verifying   : krb5-libs-1.15.1-1.fc27.i686                               3/13 
  Verifying   : libcom_err-1.43.4-2.fc26.i686                              4/13 
  Verifying   : libidn2-0.16-2.fc26.i686                                   5/13 
  Verifying   : libnghttp2-1.20.0-1.fc26.i686                              6/13 
  Verifying   : libpsl-0.17.0-2.fc26.i686                                  7/13 
  Verifying   : nss-pem-1.0.3-2.fc27.i686                                  8/13 
  Verifying   : openldap-2.4.44-8.fc26.i686                                9/13 
  Verifying   : libverto-0.2.6-7.fc26.i686                                10/13 
  Verifying   : libunistring-0.9.7-1.fc26.i686                            11/13 
  Verifying   : cyrus-sasl-lib-2.1.26-28.fc26.i686                        12/13 
  Verifying   : libdb-5.3.28-17.fc26.i686                                 13/13 

Installed:
  libcurl-devel.i686 7.53.1-3.fc27      cyrus-sasl-lib.i686 2.1.26-28.fc26     
  krb5-libs.i686 1.15.1-1.fc27          libcom_err.i686 1.43.4-2.fc26          
  libcurl.i686 7.53.1-3.fc27            libdb.i686 5.3.28-17.fc26              
  libidn2.i686 0.16-2.fc26              libnghttp2.i686 1.20.0-1.fc26          
  libpsl.i686 0.17.0-2.fc26             libunistring.i686 0.9.7-1.fc26         
  libverto.i686 0.2.6-7.fc26            nss-pem.i686 1.0.3-2.fc27              
  openldap.i686 2.4.44-8.fc26          

Complete!

Looks good. I guess F26 should be next but that's in alpha freeze :-(

The Alpha Freeze announcement says:

    "Other builds will remain in updates-testing until the Alpha release is
    approved, at which point the Alpha freeze is lifted and packages can move
    to 'stable' as usual until the Beta freeze."

So I will submit an update for F26 and we will see if this bug gets fixed in updates-testing, too.

Hmm, that should be interesting.

curl-7.53.1-3.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-328842aed1

curl-7.53.1-3.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-328842aed1

curl-7.53.1-3.fc26 nss-pem-1.0.3-3.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-328842aed1

curl-7.53.1-3.fc26, nss-pem-1.0.3-3.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-328842aed1

curl-7.53.1-3.fc26, nss-pem-1.0.3-3.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

nss-pem-1.0.3-3.fc25 curl-7.51.0-5.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-bb919b7642

curl-7.51.0-5.fc25, nss-pem-1.0.3-3.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-bb919b7642

curl-7.51.0-5.fc25, nss-pem-1.0.3-3.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.