60911 - PSM must build on MAC for Mozilla users

Status: VERIFIED FIXED

(Core :: Security: PSM, defect, P3)

Description

[David P. Drinan]

PSM must build as part of the regular mozilla build for MAC.

Comment 1

[Ben Bucksch (:BenB)]

se, it's not really pp, since there are identical bugs for Windows and Linux :).

Comment 2

[Javier Delgadillo]

Attachment: Initial patch for building PSM from fully open source on Mac.

Comment 3

[Simon Fraser [no longer active]]

I note that you only touch the new scripts (in build_scripts), not the old ones. 
At present, we're still using both, so you should probably change both.

Also, what's with the comment about failing to load the shared lib via alias? Is 
that a separate bug that needs fixing?

Comment 4

[Javier Delgadillo]

The patch in this bug builds PSM from source gathered from mozilla.

I haven't been able to verify in my debug build because for some reason, the
components loader on the Mac doesn't seem to be able to load PSMGlueDebug.shlg

When I built the optimized version of PSM, and replaced the PSM that came with
Netscape6 RTM, it all worked.  The PKCS#11 module containing the root
certificates loaded, and I was able to do SSL and open up the security advisor.

Any Mac guys out there willing to test this patch on their machines?  (I'll
continue to look at why PSMGlueDebug.shlb doesn't load anymore, but since I
think that's independent of this patch, it'd be nice if someone else tested this
patch out.)

I've got the old scripts patched as well.  I'll attach that diff shortly.

Comment 5

[Javier Delgadillo]

The alias thing is weird.  NSS calls PR_LoadLibrary with a path to load a
PKCS#11 module that has all of the root certificates in it.  In debug builds,
when the shared library was sym-linked, the PR_LoadLibrary call failed.  When I
copied the shared library over, everything just worked.

Since getting a bug fixed in NSS would cause us to wait for a new release which
we don't know about, I opted for always copying since this really only affected
debug/developer trees and the shared library was extremely small and seemed like
a straight forward workaround.

Comment 6

[Javier Delgadillo]

Attachment: New diff which incorporates changes to the old build scripts as well.

Comment 7

[Javier Delgadillo]

Attachment: The real patch. Previous patch contains NGLayoutBuilList.pm patches twice and doesn't include MozillaBuildList.pm diffs.

Comment 8

[Javier Delgadillo]

OK, my inability to create this patch, leads me to believe that I should just go
home and finish resting this cold away.  The latest attachment is correct.

sfraser or beard, if you're brave try it and let me know what happens.  (Both
scripts have worked for me in the past, but given that I can't seem to think
straight on all of these decongestants, I'll fully verify that at a later time.)

Comment 9

[Javier Delgadillo]

Attachment: This is the real thing. With this patch, SSL works for Mozilla!!!

Comment 10

[Mike Pinkerton (not reading bugmail)]

looks reasonable, but i didn't try it.

Comment 11

[Javier Delgadillo]

I was thinking of posting this to macdev newsgroup and having people try it
there first before checking in.  Would that be a bad idea?

Comment 12

[Simon Fraser [no longer active]]

This works well. Can we turn off all the PSM dumps though, for debug builds? It 
makes things really slow.

sr=sfraser on the script changes.

Comment 13

[Javier Delgadillo]

sfraser, do I also need a= to check in?

Comment 14

[Simon Fraser [no longer active]]

You need an r= also.
Do we need to fix up the commercial scripts to stop building stuff there?

Comment 15

[Javier Delgadillo]

Doh, forgot about the commercial scripts.  Once this lands, all security related
parts of the commercial script can be stripped out.

Comment 16

[Javier Delgadillo]

Attachment: Latest patch which disables PSM builds by default

Comment 17

[Javier Delgadillo]

It was recently brought to my attention that we cannot turn PSM on by default in
Mozilla builds due to export laws.  So I've attached a new patch that disables
PSM by default, but the user can set an option to turn on building PSM.

Comment 18

[Simon Fraser [no longer active]]

sr=sfraser

Comment 19

[Javier Delgadillo]

I still need a r= for this to get checked in.

beard, pinkerton?  Can one of you review this.

Comment 20

[Patrick C. Beard]

r=beard

Comment 21

[Javier Delgadillo]

Fix checked in.  Mozilla users can now build PSM entirely from mozilla source if
they include the following line in their preference file for mozilla builds:


options psm 1

Comment 22

[John Unruh]

Verified fixed.