Bug#1147760: libnss3: please make the build reproducible

[Tianyu Chen]

Package: libnss3
Version: 2:3.128-1
Tags: patch
User: reproducible-builds at lists.alioth.debian.org
Usertags: randomness
X-Debbugs-Cc: reproducible-bugs at lists.alioth.debian.org, sweetyfish at deepin.org

Hi,

I noticed libnss3 is not reproducible, so I did a look at the issue.

The files caused the package unreproducible are libfreebl3.chk,
libfreeblpriv3.chk, libnssdbm3.chk and libsoftokn3.chk. Each of these
four files contains a header, a build-time generated HMAC key, and an
HMAC signature.

These files are generated by shlibsign, after dh_strip. As the HMAC key
is generated every build, the .chk files aren't reproducible.

shlibsign accepts a `-K <key>` option, a fixed key could make these
files and the package reproducible.

Please also see:
https://bugzilla.mozilla.org/show_bug.cgi?id=1902078
https://reproduce.debian.net/amd64/forky.html#libnss3
https://tests.reproducible-builds.org/debian/rb-pkg/forky/amd64/nss.html

Best,
Tianyu Chen @ deepin

diff -Nru nss-3.128/debian/rules nss-3.128/debian/rules
--- nss-3.128/debian/rules      2026-05-20 13:34:44.000000000 +0800
+++ nss-3.128/debian/rules      2026-09-02 10:14:23.000000000 +0800
@@ -179,7 +179,7 @@
 override_dh_strip:
 	dh_strip
 	$(foreach lib,libsoftokn3.so libfreebl3.so libfreeblpriv3.so libnssdbm3.so, \
-		$(call cmd,umask 022; $(SHLIBSIGN) -v -i debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/$(lib)))
+		$(call cmd,umask 022; $(SHLIBSIGN) -v -K 0000000000000000000000000000000000000000000000000000000000000000 -i debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/$(lib)))
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works