Hacking NSS: Difference between revisions
(working process on f32) |
(show how to make things stick) |
||
Line 34: | Line 34: | ||
/usr/share/xmlto/format/docbook/html | /usr/share/xmlto/format/docbook/html | ||
hack <tt>nss.spec</tt>so that it has a unique suffix: | |||
build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1_lsw%/' nss.spec | |||
build# fedpkg verrel | |||
nss-3.63.0-1_lsw.fc32 | |||
hobble running tests during the build (optional): | |||
build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec | build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec | ||
finally build | finally build: | ||
build# fedpkg local --without tests: | build# fedpkg local --without tests: | ||
or: | or: | ||
build# fedpkg prep --without tests | build# fedpkg prep --without tests | ||
build# fedpkg compile --short-circuit --without tests | build# fedpkg compile --short-circuit --without tests | ||
the RPMs are under <tt>x86_64</tt>. | |||
==== ... using <tt>fedpkg mock</tt> and the Fedora host ==== | ==== ... using <tt>fedpkg mock</tt> and the Fedora host ==== | ||
Line 49: | Line 56: | ||
fedpkg mockbuild | fedpkg mockbuild | ||
=== | === Installing the NSS RPMs (and making them stick) === | ||
The NSS RPMs can either be installed manually on <tt>build</tt> (which means they only stick around until <tt>./kvm uninstall</tt>), or they can be made more permenant by installing them into the base domain. | |||
To install the RPMs on the base domain, add the following lines to Makefile.inc.local: | |||
# Prepend the directory containing the RPMs, include / | |||
KVM_NSS_RPMDIR = /pool/nss/x86_64/ | |||
# Append the actual RPM version | |||
KVM_NSS_VERSION = -3.63.0-1_lsw.fc32.x86_64.rpm | |||
and then upgrade the base domain: | |||
$ ./kvm upgrade | |||
... | |||
Upgrading : nss-util-3.63.0-1_lsw.fc32.x86_64 1/20 | |||
... | |||
and confirm: | |||
$ ./kvm install | |||
$ ./kvm sh east | |||
east# rpm -q nss | |||
nss-3.63.0-1_lsw.fc32.x86_64 | |||
If needed, the the customisd domains can be reverted. In Makefile.inc.local, comment out the lines added above, and then run: | |||
$ ./kvm downgrade | |||
$ ./kvm upgrade | |||
... | |||
Installing : nss-util-3.63.0-1.fc32.x86_64 13/330 | |||
=== | === Distributing Custom NSS RPMs === | ||
Tar up both the .rpm and .srpm files into a single archive and make that available. That way, who ever downloads the archive always gets the source code. |
Revision as of 20:31, 27 October 2021
Using NSS from Pluto
use lsw_nss_error*() to report errors
It includes both the error symbol name and the error message (the former is really useful when reading the code^D^D^D^D documentation when tracking down why the error was returned).
Debugging NSS
Linking libreswan against a custom NSS build
Building and Installing a Custom NSS RPMs
Below are notes on building the latest Fedora RPM on the build machine.
Build Custom NSS RPM ...
... using fedpkg local and a KVM
Here, we use the build machine (it has lots of memory and network access) and the 9p mounted directory /pool (aka $(KVM_POOLDIR), but /testing and /root should also work). Just remember that any changes to build aren't permanent, we'll get to that later.
First lets set things up:
$ ./kvm sh build build# cd /pool build# dnf install -y fedpkg build# cat /etc/fedora-release Fedora release 32 (Thirty Two) build# fedpkg clone --branch f32 --anonymous nss build# cd nss build# dnf builddep nss
Next is to hack xmlto so that it doesn't try to preserve permissions when copying files within the 9p file system (remember, ./kvm uninstall install will wipe this):
build# sed -i -e 's/ -p / /' \ /usr/share/xmlto/format/docbook/man \ /usr/share/xmlto/format/docbook/html
hack nss.specso that it has a unique suffix:
build# sed -i -e '/Release:/ s/\([0-9]*\)%/\1_lsw%/' nss.spec build# fedpkg verrel nss-3.63.0-1_lsw.fc32
hobble running tests during the build (optional):
build# sed -i -e 's/bcond_without tests/bcond_with tests/' nss.spec
finally build:
build# fedpkg local --without tests:
or:
build# fedpkg prep --without tests build# fedpkg compile --short-circuit --without tests
the RPMs are under x86_64.
... using fedpkg mock and the Fedora host
Hmm, something goes here!
fedpkg mock-config fedpkg mockbuild
Installing the NSS RPMs (and making them stick)
The NSS RPMs can either be installed manually on build (which means they only stick around until ./kvm uninstall), or they can be made more permenant by installing them into the base domain.
To install the RPMs on the base domain, add the following lines to Makefile.inc.local:
# Prepend the directory containing the RPMs, include / KVM_NSS_RPMDIR = /pool/nss/x86_64/ # Append the actual RPM version KVM_NSS_VERSION = -3.63.0-1_lsw.fc32.x86_64.rpm
and then upgrade the base domain:
$ ./kvm upgrade ... Upgrading : nss-util-3.63.0-1_lsw.fc32.x86_64 1/20 ...
and confirm:
$ ./kvm install $ ./kvm sh east east# rpm -q nss nss-3.63.0-1_lsw.fc32.x86_64
If needed, the the customisd domains can be reverted. In Makefile.inc.local, comment out the lines added above, and then run:
$ ./kvm downgrade $ ./kvm upgrade ... Installing : nss-util-3.63.0-1.fc32.x86_64 13/330
Distributing Custom NSS RPMs
Tar up both the .rpm and .srpm files into a single archive and make that available. That way, who ever downloads the archive always gets the source code.