#40316 - nss not reproducible - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #30 received at 40316@debbugs.gnu.org (full text, mbox, reply):

Received: (at 40316) by debbugs.gnu.org; 25 Apr 2024 14:07:26 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 25 10:07:25 2024
Received: from localhost ([127.0.0.1]:60807 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1rzzkx-0004Wj-83
	for submit@debbugs.gnu.org; Thu, 25 Apr 2024 10:07:25 -0400
Received: from vmi993448.contaboserver.net ([194.163.141.236]:50010
 helo=mutix.org) by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <cdo@mutix.org>) id 1rzzkr-0004VQ-Pf
 for 40316@debbugs.gnu.org; Thu, 25 Apr 2024 10:07:20 -0400
Received: from [192.168.1.172]
 (host81-152-149-149.range81-152.btcentralplus.com [81.152.149.149])
 (Authenticated sender: cdo)
 by mutix.org (Postfix) with ESMTPSA id 88333A63ACC;
 Thu, 25 Apr 2024 16:06:58 +0200 (CEST)
Message-ID: <2dc99b59-cb76-f822-f2ce-027f523bb682@mutix.org>
Date: Thu, 25 Apr 2024 15:06:58 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.15.0
Subject: Re: Core updates status
Content-Language: en-US
To: 40316@debbugs.gnu.org
References: <Ziihyt5dYdvv_fRR@dragon2>
 <451a97f9-0e16-c1b3-8884-52420e265db3@mutix.org>
 <quwzpv6nqevtbdp2galghxgx3x23zmsppmm6gcmpj3siqrrbud@r27tt6htlol3>
From: Christina O'Donnell <cdo@mutix.org>
In-Reply-To: <quwzpv6nqevtbdp2galghxgx3x23zmsppmm6gcmpj3siqrrbud@r27tt6htlol3>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spam-Score: -3.0 (---)
X-Debbugs-Envelope-To: 40316
Cc: guix-devel@gnu.org, Steve George <steve@futurile.net>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -4.0 (----)

Hi Steve,

> It would be good to confirm this one:
>
> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=40316

Still fails to reproduce with those changes applied.

The culprit is in nss/cmd/shlibsign/shlibsign.c:

shlibSignHMAC generates a new key-pair each time it's run:

    /* Generate a DSA key pair */
    logIt("Generate an HMAC key ... \n");
    crv = pFunctionList->C_GenerateKey(hRwSession, &hmacKeyGenMech,
                                       hmacKeyTemplate,
PR_ARRAY_SIZE(hmacKeyTemplate),
                                       &hHMACKey);

Three options:
 1. Disable library signing entirely.
 2. Seed the generation to be deterministic.
 3. Drop in a HMAC key-pair and patch the code to use that instead of 
generating.

2 and 3 defeat the point of the cryptographically secure supply chain as 
the private key can be obtained deterministically, so my vote would be 
simply  to not sign the libraries (1), which would be easier to 
maintain. We're not the primary distributor and users can verify our 
distribution of nss by running `guix challenge` anyway.

> It looks like Zhen Junjie applied two patches to fix NSS cross-compilation on Master [0]

Building everything cross-compiled to ARM now.

Kind regards,

Christina

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Wed Sep 10 15:38:59 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#40316 nss not reproducible