Subject: Re: bug#32833: IceCat 60 certificate validation fails when using system NSS
From: Maxim Cournoyer <[email-masked]>
To: Mike Gerwitz <[email-masked]>
Cc: Mark H Weaver <[email-masked]>, [email-masked]
Date: Mon, 28 Aug 2023 23:40:23 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Hello,

Mike Gerwitz <[email-masked]> writes:

> On Tue, Sep 25, 2018 at 20:16:16 -0400, Mark H Weaver wrote:
>> Mark H Weaver <[email-masked]> writes:
>>> To begin, I'm currently building IceCat using the bundled NSPR and NSS,
>>> to see if that helps.
>>
>> Using the bundled NSPR and NSS works around the problem for me.  I just
>> pushed this change in commit 6d328879378fac95240005233331f596fb5c68ed on
>> 'master'.  See also the related, immediately preceding commits
>> 257e3247910610fe24ae1b86f38e85552d53e48c and
>> 94e96f7f68c3b9053fdb5dee5b0ab614163aaa08.
>
> Great!
>
>> I'm keeping this bug report open, since it would be good to find a
>> better fix which avoids using the bundled libraries.
>
> I wish I knew enough to suggest a better solution.
>
> It's a little late now, but I just tested the IceCat binary on a Debian
> machine and HTTPS works as expected.
>
> Thanks again for your work on this.  Maybe I'll let IceCat build
> overnight so I can give it a try tomorrow (still on my X200).

I'm closing this issue, since we're now using the Guix provided nss and
nspr packages for building IceCat since a while, and there doesn't
appear to be an issue with doing so.

-- 
Thanks,
Maxim