Re: dropping NSS DBM format support in F33+

[Justin Forbes]

On Sat, Apr 25, 2020 at 10:21 AM Daiki Ueno  wrote:
> Hello Ondrej,
>
> Ondrej Mosnacek  writes:
> > On Fri, Apr 24, 2020 at 11:12 PM Ondrej Mosnacek  wrote:
> > > On Fri, Apr 24, 2020 at 8:50 PM Ondrej Mosnacek  wrote:
> > > > On Wed, Apr 22, 2020 at 10:12 AM Daiki Ueno  wrote:
> > > > > Hello,
> > > > >
> > > > > I am not sure if this deserves a Fedora Change proposal, so I'd like to
> > > > > hear any opinions first before proceeding with the process.
> > > > >
> > > > > NSS (the crypto library used by Firefox) historically supports 2
> > > > > database formats: SQLite and DBM.  The latter is considered legacy and
> > > > > we switched the default database format to SQLite in F28[1].  Since then
> > > > > I presume most of the applications have switched to the new format.
> > > > > Therefore we are planning to phase out the support of DBM, targetting
> > > > > F33+.
> > > > >
> > > > > Please let me know if there is any concern.
> > > >
> > > > It seems this broke the kernel build. I did some scratch build today
> > > > to test some patches, but it failed with this:
> > > > /usr/bin/pesign -c 'Red Hat Test Certificate' --certdir
> > > >
> > > > /etc/pki/pesign-rh-test -i arch/x86/boot/bzImage -o vmlinuz.signed -s
> > > > pesign: Could not initialize nss.
> > > > NSS says "The certificate/key database is in an old, unsupported
> > > > format." errno says "No such file or directory"
> > > > error: Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > RPM build errors:
> > > >     Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > Child return code was: 1
> > >
> > > Probably related: https://github.com/rhboot/pesign/issues/34
> >
> > I filed a bug against pesign here:
> > https://bugzilla.redhat.com/show_bug.cgi?id=1827902
>
> Good catch, and thank you for filing the bug.  For the meantime I
> reverted the DBM disablement to unblock the kernel package build:
> https://src.fedoraproject.org/rpms/nss/c/fc0174ead16bac476cce55fb2918fbfd9b4...

Thanks for that, I know they were working on a fix for pesign on
Friday, but I am not sure what their timeframe is.

Justin

dropping NSS DBM format support in F33+

[Paul Moore]

On Sat, Apr 25, 2020 at 1:21 PM Justin Forbes  wrote:
> On Sat, Apr 25, 2020 at 10:21 AM Daiki Ueno  wrote:
> > Hello Ondrej,
> >
> > Ondrej Mosnacek  writes:
> > > On Fri, Apr 24, 2020 at 11:12 PM Ondrej Mosnacek  wrote:
> > > > On Fri, Apr 24, 2020 at 8:50 PM Ondrej Mosnacek  wrote:
> > > > > On Wed, Apr 22, 2020 at 10:12 AM Daiki Ueno  wrote:
> > > > > > Hello,
> > > > > >
> > > > > > I am not sure if this deserves a Fedora Change proposal, so I'd like to
> > > > > > hear any opinions first before proceeding with the process.
> > > > > >
> > > > > > NSS (the crypto library used by Firefox) historically supports 2
> > > > > > database formats: SQLite and DBM.  The latter is considered legacy and
> > > > > > we switched the default database format to SQLite in F28[1].  Since then
> > > > > > I presume most of the applications have switched to the new format.
> > > > > > Therefore we are planning to phase out the support of DBM, targetting
> > > > > > F33+.
> > > > > >
> > > > > > Please let me know if there is any concern.
> > > > >
> > > > > It seems this broke the kernel build. I did some scratch build today
> > > > > to test some patches, but it failed with this:
> > > > > /usr/bin/pesign -c 'Red Hat Test Certificate' --certdir
> > > > >
> > > > > /etc/pki/pesign-rh-test -i arch/x86/boot/bzImage -o vmlinuz.signed -s
> > > > > pesign: Could not initialize nss.
> > > > > NSS says "The certificate/key database is in an old, unsupported
> > > > > format." errno says "No such file or directory"
> > > > > error: Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > RPM build errors:
> > > > >     Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > Child return code was: 1
> > > >
> > > > Probably related: https://github.com/rhboot/pesign/issues/34
> > >
> > > I filed a bug against pesign here:
> > > https://bugzilla.redhat.com/show_bug.cgi?id=1827902
> >
> > Good catch, and thank you for filing the bug.  For the meantime I
> > reverted the DBM disablement to unblock the kernel package build:
> > https://src.fedoraproject.org/rpms/nss/c/fc0174ead16bac476cce55fb2918fbfd9b4...
>
> Thanks for that, I know they were working on a fix for pesign on
> Friday, but I am not sure what their timeframe is.

I hit this over the weekend, does anyone have a workaround?

dropping NSS DBM format support in F33+

[Ondrej Mosnacek]

On Mon, Apr 27, 2020 at 5:54 PM Paul Moore  wrote:
> On Sat, Apr 25, 2020 at 1:21 PM Justin Forbes  wrote:
> > On Sat, Apr 25, 2020 at 10:21 AM Daiki Ueno  wrote:
> > > Hello Ondrej,
> > >
> > > Ondrej Mosnacek  writes:
> > > > On Fri, Apr 24, 2020 at 11:12 PM Ondrej Mosnacek  wrote:
> > > > > On Fri, Apr 24, 2020 at 8:50 PM Ondrej Mosnacek  wrote:
> > > > > > On Wed, Apr 22, 2020 at 10:12 AM Daiki Ueno  wrote:
> > > > > > > Hello,
> > > > > > >
> > > > > > > I am not sure if this deserves a Fedora Change proposal, so I'd like to
> > > > > > > hear any opinions first before proceeding with the process.
> > > > > > >
> > > > > > > NSS (the crypto library used by Firefox) historically supports 2
> > > > > > > database formats: SQLite and DBM.  The latter is considered legacy and
> > > > > > > we switched the default database format to SQLite in F28[1].  Since then
> > > > > > > I presume most of the applications have switched to the new format.
> > > > > > > Therefore we are planning to phase out the support of DBM, targetting
> > > > > > > F33+.
> > > > > > >
> > > > > > > Please let me know if there is any concern.
> > > > > >
> > > > > > It seems this broke the kernel build. I did some scratch build today
> > > > > > to test some patches, but it failed with this:
> > > > > > /usr/bin/pesign -c 'Red Hat Test Certificate' --certdir
> > > > > >
> > > > > > /etc/pki/pesign-rh-test -i arch/x86/boot/bzImage -o vmlinuz.signed -s
> > > > > > pesign: Could not initialize nss.
> > > > > > NSS says "The certificate/key database is in an old, unsupported
> > > > > > format." errno says "No such file or directory"
> > > > > > error: Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > > RPM build errors:
> > > > > >     Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > > Child return code was: 1
> > > > >
> > > > > Probably related: https://github.com/rhboot/pesign/issues/34
> > > >
> > > > I filed a bug against pesign here:
> > > > https://bugzilla.redhat.com/show_bug.cgi?id=1827902
> > >
> > > Good catch, and thank you for filing the bug.  For the meantime I
> > > reverted the DBM disablement to unblock the kernel package build:
> > > https://src.fedoraproject.org/rpms/nss/c/fc0174ead16bac476cce55fb2918fbfd9b4...
> >
> > Thanks for that, I know they were working on a fix for pesign on
> > Friday, but I am not sure what their timeframe is.
>
> I hit this over the weekend, does anyone have a workaround?

The NSS change has been reverted, so kernel builds should work now
(worked for me this morning [CEST]).

dropping NSS DBM format support in F33+

[Paul Moore]

On Mon, Apr 27, 2020 at 12:01 PM Ondrej Mosnacek  wrote:
> On Mon, Apr 27, 2020 at 5:54 PM Paul Moore  wrote:
> > On Sat, Apr 25, 2020 at 1:21 PM Justin Forbes  wrote:
> > > On Sat, Apr 25, 2020 at 10:21 AM Daiki Ueno  wrote:
> > > > Hello Ondrej,
> > > >
> > > > Ondrej Mosnacek  writes:
> > > > > On Fri, Apr 24, 2020 at 11:12 PM Ondrej Mosnacek  wrote:
> > > > > > On Fri, Apr 24, 2020 at 8:50 PM Ondrej Mosnacek  wrote:
> > > > > > > On Wed, Apr 22, 2020 at 10:12 AM Daiki Ueno  wrote:
> > > > > > > > Hello,
> > > > > > > >
> > > > > > > > I am not sure if this deserves a Fedora Change proposal, so I'd like to
> > > > > > > > hear any opinions first before proceeding with the process.
> > > > > > > >
> > > > > > > > NSS (the crypto library used by Firefox) historically supports 2
> > > > > > > > database formats: SQLite and DBM.  The latter is considered legacy and
> > > > > > > > we switched the default database format to SQLite in F28[1].  Since then
> > > > > > > > I presume most of the applications have switched to the new format.
> > > > > > > > Therefore we are planning to phase out the support of DBM, targetting
> > > > > > > > F33+.
> > > > > > > >
> > > > > > > > Please let me know if there is any concern.
> > > > > > >
> > > > > > > It seems this broke the kernel build. I did some scratch build today
> > > > > > > to test some patches, but it failed with this:
> > > > > > >
> > > > > > > + /usr/bin/pesign -c 'Red Hat Test Certificate' --certdir
> > > > > > > /etc/pki/pesign-rh-test -i arch/x86/boot/bzImage -o vmlinuz.signed -s
> > > > > > > pesign: Could not initialize nss.
> > > > > > > NSS says "The certificate/key database is in an old, unsupported
> > > > > > > format." errno says "No such file or directory"
> > > > > > > error: Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > > > RPM build errors:
> > > > > > >     Bad exit status from /var/tmp/rpm-tmp.YKqoK0 (%build)
> > > > > > > Child return code was: 1
> > > > > >
> > > > > > Probably related: https://github.com/rhboot/pesign/issues/34
> > > > >
> > > > > I filed a bug against pesign here:
> > > > > https://bugzilla.redhat.com/show_bug.cgi?id=1827902
> > > >
> > > > Good catch, and thank you for filing the bug.  For the meantime I
> > > > reverted the DBM disablement to unblock the kernel package build:
> > > > https://src.fedoraproject.org/rpms/nss/c/fc0174ead16bac476cce55fb2918fbfd9b4...
> > >
> > > Thanks for that, I know they were working on a fix for pesign on
> > > Friday, but I am not sure what their timeframe is.
> >
> > I hit this over the weekend, does anyone have a workaround?
>
> The NSS change has been reverted, so kernel builds should work now
> (worked for me this morning [CEST]).

It is still failing for me on a current Rawhide system.  Is there some
other magic I need to do?