FS#54387 - [nss] Version 3.31-2 breaks Chromium

Attached to Project: Arch Linux
Opened by Peet (orangecake) - Friday, 09 June 2017, 15:03 GMT
Last edited by Jan Alexander Steffens (heftig) - Friday, 09 June 2017, 17:39 GMT
Task Type Bug Report
Category Packages: Testing
Status Closed
Assigned To Jan de Groot (JGC)
Jan Alexander Steffens (heftig)
Architecture All
Severity High
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 10
Private No

Details

Description:
The current nss (3.31-2 in testing) breaks chromium.

Additional info:

nss: 3.31-2/testing
chromium: 59.0.3071.86-1


Steps to reproduce:
Upgrade to the latest nss. Start chromium and try to open any website. You will get an error.
This task depends upon

Closed by  Jan Alexander Steffens (heftig)
Friday, 09 June 2017, 17:39 GMT
Reason for closing:  Fixed
Additional comments about closing:  nss 3.31-3
Comment by Brian McCord (beest) - Friday, 09 June 2017, 15:44 GMT
More specifically (at least here) it breaks https; unsecured sites display fine. Also happening on Webengine browsers. Firefox is unaffected.
Comment by Bastian Beranek (totsilence) - Friday, 09 June 2017, 15:47 GMT
Error messages from chromium when invoked from terminal:

[9256:9269:0609/174619.440995:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for www.googleapis.com failed err=-5992
[9256:9270:0609/174619.456975:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for accounts.google.com failed err=-5992
[9256:9337:0609/174619.503109:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for lh3.googleusercontent.com failed err=-5992
[9256:9269:0609/174619.505169:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for ogs.google.com failed err=-5992
[9256:9270:0609/174619.507485:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for apis.google.com failed err=-5992
[9256:9337:0609/174619.509028:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for ssl.gstatic.com failed err=-5992
[9256:9269:0609/174619.510733:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for clients5.google.com failed err=-5992
[9256:9270:0609/174619.518436:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for www.gstatic.com failed err=-5992
[9256:9269:0609/174619.539263:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for www.google.de failed err=-5992
[9256:9270:0609/174619.540918:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for translate.googleapis.com failed err=-5992
[9256:9269:0609/174619.631614:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for mtalk.google.com failed err=-5992
[9256:9281:0609/174619.652388:ERROR:connection_factory_impl.cc(386)] Failed to connect to MCS endpoint with error -2
[9256:9337:0609/174619.793479:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for clients2.google.com failed err=-5992
[9256:9269:0609/174621.271996:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for www.google.de failed err=-5992
[9256:9270:0609/174624.401572:ERROR:cert_verify_proc_nss.cc(923)] CERT_PKIXVerifyCert for www.google.com failed err=-5992

and so on.
Comment by Franziskus Kiefer (franziskuskiefer) - Friday, 09 June 2017, 17:22 GMT
Ugh, well libpkix isn't built by default anymore. This can be fixed by either patching coreconf/config.gypi and set disable_libpkix=0 or use the attached patch and call build.sh with --enable-libpkix. (In any case, it requires --disable-tests or more patches to make those link properly.)
   enable-libpkix.patch (1 KiB)

Loading...