Package: libnss3 Version: 2:3.128-1 Tags: patch User: [email protected] Usertags: randomness X-Debbugs-Cc: [email protected], [email protected]
Hi, I noticed libnss3 is not reproducible, so I did a look at the issue. The files caused the package unreproducible are libfreebl3.chk, libfreeblpriv3.chk, libnssdbm3.chk and libsoftokn3.chk. Each of these four files contains a header, a build-time generated HMAC key, and an HMAC signature. These files are generated by shlibsign, after dh_strip. As the HMAC key is generated every build, the .chk files aren't reproducible. shlibsign accepts a `-K <key>` option, a fixed key could make these files and the package reproducible. Please also see: https://bugzilla.mozilla.org/show_bug.cgi?id=1902078 https://reproduce.debian.net/amd64/forky.html#libnss3 https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/nss.html Best, Tianyu Chen @ deepin diff -Nru nss-3.128/debian/rules nss-3.128/debian/rules --- nss-3.128/debian/rules 2026-05-20 13:34:44.000000000 +0800 +++ nss-3.128/debian/rules 2026-09-02 10:14:23.000000000 +0800 @@ -179,7 +179,7 @@ override_dh_strip: dh_strip $(foreach lib,libsoftokn3.so libfreebl3.so libfreeblpriv3.so libnssdbm3.so, \ - $(call cmd,umask 022; $(SHLIBSIGN) -v -i debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/$(lib))) + $(call cmd,umask 022; $(SHLIBSIGN) -v -K 0000000000000000000000000000000000000000000000000000000000000000 -i debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/$(lib))) ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH)) # Check FIPS mode correctly works
