Hacking NSS: Difference between revisions

From Libreswan
Jump to navigation Jump to search
(working process on f32)
(show how to make things stick)
Line 34: Line 34:
     /usr/share/xmlto/format/docbook/html
     /usr/share/xmlto/format/docbook/html


optionally, hobble tests during the build:
hack <tt>nss.spec</tt>so that it has a unique suffix:
build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1_lsw%/' nss.spec
build# fedpkg verrel
nss-3.63.0-1_lsw.fc32
 
hobble running tests during the build (optional):
  build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec
  build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec


finally build (something better?):
finally build:
  build# fedpkg local --without tests:
  build# fedpkg local --without tests:
or:
or:
  build# fedpkg prep --without tests
  build# fedpkg prep --without tests
  build# fedpkg compile --short-circuit --without tests
  build# fedpkg compile --short-circuit --without tests
the RPMs are under <tt>x86_64</tt>.


==== ... using <tt>fedpkg mock</tt> and the Fedora host ====
==== ... using <tt>fedpkg mock</tt> and the Fedora host ====
Line 49: Line 56:
  fedpkg mockbuild
  fedpkg mockbuild


=== Making the Custom NSS RPs Stick ===
=== Installing the NSS RPMs (and making them stick) ===
 
The NSS RPMs can either be installed manually on <tt>build</tt> (which means they only stick around until <tt>./kvm uninstall</tt>), or they can be made more permenant by installing them into the base domain.
 
To install the RPMs on the base domain, add the following lines to Makefile.inc.local:
# Prepend the directory containing the RPMs, include /
KVM_NSS_RPMDIR = /pool/nss/x86_64/
# Append the actual RPM version
KVM_NSS_VERSION = -3.63.0-1_lsw.fc32.x86_64.rpm
and then upgrade the base domain:
$ ./kvm upgrade
...
  Upgrading        : nss-util-3.63.0-1_lsw.fc32.x86_64                    1/20
...
and confirm:
$ ./kvm install
$ ./kvm sh east
east# rpm -q nss
nss-3.63.0-1_lsw.fc32.x86_64
 
If needed, the the customisd domains can be reverted.  In Makefile.inc.local, comment out the lines added above, and then run:
$ ./kvm downgrade
$ ./kvm upgrade
...
  Installing      : nss-util-3.63.0-1.fc32.x86_64                      13/330


=== Distribute Custom NSS RPMs ===
=== Distributing Custom NSS RPMs ===


For legal reasons, tar up both the .rpm and .srpm files into a single archive and make that available - it forces whoever is using the RPMs to also download the sources.
Tar up both the .rpm and .srpm files into a single archive and make that available.  That way, who ever downloads the archive always gets the source code.

Revision as of 20:31, 27 October 2021

Using NSS from Pluto

use lsw_nss_error*() to report errors

It includes both the error symbol name and the error message (the former is really useful when reading the code^D^D^D^D documentation when tracking down why the error was returned).

Debugging NSS

Linking libreswan against a custom NSS build

Building and Installing a Custom NSS RPMs

Below are notes on building the latest Fedora RPM on the build machine.

Build Custom NSS RPM ...

... using fedpkg local and a KVM

Here, we use the build machine (it has lots of memory and network access) and the 9p mounted directory /pool (aka $(KVM_POOLDIR), but /testing and /root should also work). Just remember that any changes to build aren't permanent, we'll get to that later.

First lets set things up:

$ ./kvm sh build
build# cd /pool
build# dnf install -y fedpkg
build# cat /etc/fedora-release
Fedora release 32 (Thirty Two)
build# fedpkg clone --branch f32 --anonymous nss
build# cd nss
build# dnf builddep nss

Next is to hack xmlto so that it doesn't try to preserve permissions when copying files within the 9p file system (remember, ./kvm uninstall install will wipe this):

build# sed -i -e 's/ -p / /' \
   /usr/share/xmlto/format/docbook/man \
   /usr/share/xmlto/format/docbook/html

hack nss.specso that it has a unique suffix:

build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1_lsw%/' nss.spec
build# fedpkg verrel
nss-3.63.0-1_lsw.fc32

hobble running tests during the build (optional):

build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec

finally build:

build# fedpkg local --without tests:

or:

build# fedpkg prep --without tests
build# fedpkg compile --short-circuit --without tests

the RPMs are under x86_64.

... using fedpkg mock and the Fedora host

Hmm, something goes here!

fedpkg mock-config
fedpkg mockbuild

Installing the NSS RPMs (and making them stick)

The NSS RPMs can either be installed manually on build (which means they only stick around until ./kvm uninstall), or they can be made more permenant by installing them into the base domain.

To install the RPMs on the base domain, add the following lines to Makefile.inc.local:

# Prepend the directory containing the RPMs, include /
KVM_NSS_RPMDIR = /pool/nss/x86_64/
# Append the actual RPM version
KVM_NSS_VERSION = -3.63.0-1_lsw.fc32.x86_64.rpm

and then upgrade the base domain:

$ ./kvm upgrade
...
 Upgrading        : nss-util-3.63.0-1_lsw.fc32.x86_64                     1/20 
...

and confirm:

$ ./kvm install
$ ./kvm sh east
east# rpm -q nss
nss-3.63.0-1_lsw.fc32.x86_64

If needed, the the customisd domains can be reverted. In Makefile.inc.local, comment out the lines added above, and then run:

$ ./kvm downgrade
$ ./kvm upgrade
...
 Installing       : nss-util-3.63.0-1.fc32.x86_64                       13/330 

Distributing Custom NSS RPMs

Tar up both the .rpm and .srpm files into a single archive and make that available. That way, who ever downloads the archive always gets the source code.