Skip to contentSkip to conversation

nss: fix non-determinism when create a blank certificate

PATCH New [email protected] 1 participant 2 messages Oct 12, 2018

lore
Share & tools
lore

[email protected]

author
#0 lore raw

v2 cover nss: fix non-determinism when create a blank certificate

From: Kai Kang <[email protected]>

V2:
* update comment in nss recipe

The following changes since commit 8a2e53b525ebc4f50c7384af056cbe67a3913282:

libxml2: Make it compatible with externalsrc (2018-10-10 17:59:09 +0100)

are available in the Git repository at:

git://git.pokylinux.org/poky-contrib kangkai/nss
http://git.pokylinux.org/cgit.cgi/poky-contrib/log/?h=kangkai/nss

Kai Kang (1):
nss: fix non-determinism when create a blank certificate

 meta/recipes-support/nss/nss/blank-cert9.db   | Bin 0 -> 28672 bytes
 meta/recipes-support/nss/nss/blank-key4.db    | Bin 0 -> 36864 bytes
 .../recipes-support/nss/nss/system-pkcs11.txt |   5 +++++
 meta/recipes-support/nss/nss_3.38.bb          |  21 +++++++++++-------
 4 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 meta/recipes-support/nss/nss/blank-cert9.db
 create mode 100644 meta/recipes-support/nss/nss/blank-key4.db
 create mode 100644 meta/recipes-support/nss/nss/system-pkcs11.txt
Signature · 1 line
2.18.0
author
#1 lore raw

PATCH v2 1/1 nss: fix non-determinism when create a blank certificate

From: Kai Kang <[email protected]>

It uses certutil from nss to create a blank certificate. But the checksum of database file key4.db changes every time:

$ certutil -N -d sql:. --empty-password
$ md5sum *
f9dac2cfcb07cc8ca6db442a9a570906  cert9.db
b892c5ff7c1977d4728240b0cf628377  key4.db
7b9136cb03f07ae62eb213a5239fda71  pkcs11.txt
$ rm *
$ certutil -N -d sql:. --empty-password
$ md5sum *
f9dac2cfcb07cc8ca6db442a9a570906  cert9.db
405d55178e866a115c1aa975fccfa764  key4.db
7b9136cb03f07ae62eb213a5239fda71  pkcs11.txt

Provide pre-created databases with a blank certificate to fix non-determinism issue. And these database files are from nss qemux86-64 build.

Signed-off-by Kai Kang <[email protected]>
---
 meta/recipes-support/nss/nss/blank-cert9.db   | Bin 0 -> 28672 bytes
 meta/recipes-support/nss/nss/blank-key4.db    | Bin 0 -> 36864 bytes
 .../recipes-support/nss/nss/system-pkcs11.txt |   5 +++++
 meta/recipes-support/nss/nss_3.38.bb          |  21 +++++++++++-------
 4 files changed, 18 insertions(+), 8 deletions(-)
 create mode 100644 meta/recipes-support/nss/nss/blank-cert9.db
 create mode 100644 meta/recipes-support/nss/nss/blank-key4.db
 create mode 100644 meta/recipes-support/nss/nss/system-pkcs11.txt
meta/recipes-support/nss/nss/blank-cert9.db new file binary +0 -0
new file mode 100644
index 0000000000000000000000000000000000000000..7d4bcf2582d510f7b51d4306706746178c41fbbc
GIT binary patch
meta/recipes-support/nss/nss/blank-key4.db new file binary +0 -0
new file mode 100644
index 0000000000000000000000000000000000000000..d47f08d04fe82197bc6a39ef9bf216b61c3dc77a
GIT binary patch
meta/recipes-support/nss/nss/system-pkcs11.txt new file +5 -0
new file mode 100644
index 0000000000..1a264e9cc4
@@ -0,0 +1,5 @@
+library=
+name=NSS Internal PKCS #11 Module
+parameters=configdir='sql:/etc/pki/nssdb' certPrefix='' keyPrefix='' secmod='secmod.db' flags= updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription='' 
+NSS=Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={slotFlags=[ECC,RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512] askpw=any timeout=30})
+
meta/recipes-support/nss/nss_3.38.bb +13 -8
index 904b621a07..e0ee209106 100644
@@ -25,6 +25,9 @@ SRC_URI = "http://ftp.mozilla.org/pub/mozilla.org/security/nss/releases/${VERSIO
            file://nss-fix-nsinstall-build.patch \
            file://disable-Wvarargs-with-clang.patch \
            file://pqg.c-ULL_addend.patch \
+           file://blank-cert9.db \
+           file://blank-key4.db \
+           file://system-pkcs11.txt \
            "
 
 SRC_URI[md5sum] = "ac9065460a7634ba8eb0f942f404e773"

@@ -212,14 +215,16 @@ do_install_append() {
 }
 
 do_install_append_class-target() {
-    # Create a blank certificate
-    mkdir -p ${D}${sysconfdir}/pki/nssdb/
-    touch ./empty_password
-    certutil -N -d sql:${D}${sysconfdir}/pki/nssdb/ -f ./empty_password
-    chmod 644 ${D}${sysconfdir}/pki/nssdb/*.db
-    rm ./empty_password
-    # Remove build path prefix
-    sed -i "s:${D}::g"  ${D}${sysconfdir}/pki/nssdb/pkcs11.txt
+    # It used to call certutil to create a blank certificate with empty password at
+    # build time, but the checksum of key4.db changes every time when certutil is called.
+    # It causes non-determinism issue, so provide databases with a blank certificate
+    # which are originally from output of nss in qemux86-64 build. You can get these
+    # databases by:
+    # certutil -N -d sql:/database/path/ --empty-password
+    install -d ${D}${sysconfdir}/pki/nssdb/
+    install -m 0644 ${WORKDIR}/blank-cert9.db ${D}${sysconfdir}/pki/nssdb/cert9.db
+    install -m 0644 ${WORKDIR}/blank-key4.db ${D}${sysconfdir}/pki/nssdb/key4.db
+    install -m 0644 ${WORKDIR}/system-pkcs11.txt ${D}${sysconfdir}/pki/nssdb/pkcs11.txt
 }
 
 PACKAGE_WRITE_DEPS += "nss-native"
Signature · 1 line
2.18.0