[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#33253: nss cannot build

From: Björn Höfling
Subject: bug#33253: nss cannot build
Date: Sun, 4 Nov 2018 17:30:14 +0100

On Sun, 4 Nov 2018 09:52:44 +0000
Gnu Röoty <address@hidden> wrote:

> HI from 2 days I build the installation of guixSD to
> berlin.guixsd.org and nss-3.36.6 cant build.

This was also reported on guix-help by Brian Woodcox.

Here is some analysis I reported to that thread:

This package does not build reproducibly. At least in the long term:
There are tests that check certificates on temporal validity and that
depends on the system time.

I can reproduce your result with the 3.39 version. It looks like one
certificate is expired. All 6 failing tests look about like this one:

s -d AllDB -pp       - PASSED
chains.sh: Verifying certificate(s)  PayPalEE.cert with flags -d AllDB -pp      
-o OID.2.16.840.1.114412.1.1 
vfychain -d AllDB -pp -vv      -o OID.2.16.840.1.114412.1.1  /tmp/guix-build-nss
Chain is bad!
CERT 0. PayPalEE :
  ERROR -8181: Peer's Certificate has expired.
Returned value is 1, expected result is pass
chains.sh: #1555: RealCerts: Verifying certificate(s)  PayPalEE.cert with flags 
-d AllDB -pp      -o OID.2.16.840.1.114412.1.1  - FAILED

I don't know how to check the expiration date of PayPalEE.cert.

It looks like upstream has not yet worked on it, as the file was lastly
modified two years ago:


Cmp also this bug that demands non-expiration certificates:


Building 3.40 does not work with just updating version/hashsum.

A quick solution would be to build nss from a Guix git-checkout and
disable tests. But it has many dependencies, so you more or less rebuild the 


Attachment: pgpwjm0Mhnoq5.pgp
Description: OpenPGP digital signature

reply via email to

[Prev in Thread] Current Thread [Next in Thread]