#40316 - nss not reproducible - GNU bug report logs

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #33 received at 40316@debbugs.gnu.org (full text, mbox, reply):

Received: (at 40316) by debbugs.gnu.org; 25 Apr 2024 17:02:21 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu Apr 25 13:02:20 2024
Received: from localhost ([127.0.0.1]:33201 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1s02U9-0002RQ-2p
	for submit@debbugs.gnu.org; Thu, 25 Apr 2024 13:02:19 -0400
Received: from vmi993448.contaboserver.net ([194.163.141.236]:59548
 helo=mutix.org) by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <cdo@mutix.org>) id 1s02Ty-0002Oy-Ue
 for 40316@debbugs.gnu.org; Thu, 25 Apr 2024 13:02:08 -0400
Received: from [192.168.1.172]
 (host81-152-149-149.range81-152.btcentralplus.com [81.152.149.149])
 (Authenticated sender: cdo)
 by mutix.org (Postfix) with ESMTPSA id 84605A63999;
 Thu, 25 Apr 2024 19:01:43 +0200 (CEST)
Message-ID: <714bd3eb-76ed-2159-9761-f8614a1b164a@mutix.org>
Date: Thu, 25 Apr 2024 18:01:42 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.15.0
Subject: Re: nss not reproducible
Content-Language: en-US
From: Christina O'Donnell <cdo@mutix.org>
To: 40316@debbugs.gnu.org
References: <Ziihyt5dYdvv_fRR@dragon2>
 <451a97f9-0e16-c1b3-8884-52420e265db3@mutix.org>
 <quwzpv6nqevtbdp2galghxgx3x23zmsppmm6gcmpj3siqrrbud@r27tt6htlol3>
 <2dc99b59-cb76-f822-f2ce-027f523bb682@mutix.org>
In-Reply-To: <2dc99b59-cb76-f822-f2ce-027f523bb682@mutix.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
X-Spam-Score: -3.0 (---)
X-Debbugs-Envelope-To: 40316
Cc: guix-devel@gnu.org, Steve George <steve@futurile.net>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -4.0 (----)

Hi,

I believe I have a fix for this, I'm just waiting on my machine to hurry 
up and confirm it, might end up running over night, then I'll send my 
patch up.

I'm doing two native builds and two cross-builds.

I've also updated to 3.99.

Kind regards,

Christina

On 25/04/2024 15:06, Christina O'Donnell wrote:
> Hi Steve,
>
>> It would be good to confirm this one:
>>
>> https://debbugs.gnu.org/cgi/bugreport.cgi?bug=40316
>
> Still fails to reproduce with those changes applied.
>
> The culprit is in nss/cmd/shlibsign/shlibsign.c:
>
> shlibSignHMAC generates a new key-pair each time it's run:
>
>     /* Generate a DSA key pair */
>     logIt("Generate an HMAC key ... \n");
>     crv = pFunctionList->C_GenerateKey(hRwSession, &hmacKeyGenMech,
>                                        hmacKeyTemplate,
> PR_ARRAY_SIZE(hmacKeyTemplate),
>                                        &hHMACKey);
>
> Three options:
>  1. Disable library signing entirely.
>  2. Seed the generation to be deterministic.
>  3. Drop in a HMAC key-pair and patch the code to use that instead of 
> generating.
>
> 2 and 3 defeat the point of the cryptographically secure supply chain 
> as the private key can be obtained deterministically, so my vote would 
> be simply  to not sign the libraries (1), which would be easier to 
> maintain. We're not the primary distributor and users can verify our 
> distribution of nss by running `guix challenge` anyway.
>
>> It looks like Zhen Junjie applied two patches to fix NSS 
>> cross-compilation on Master [0]
>
> Building everything cross-compiled to ARM now.
>
> Kind regards,
>
> Christina
>
>

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Wed Sep 10 12:17:17 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#40316 nss not reproducible