Mac Signing issues - the weirdness continues

[mkaply]

OK, so now I'm really confused. I've done some testing and I am getting
predictable but very confusing results.

I've figured out when the extra thawte cert shows up in my DB and screws
things up.

Note this is all with NSS 3.12

I built NSS 3.12 opt.

Then I put the dylibs and the bin for certutil/signtool/pk12util into my
/opt/local/bin directory.

When I run certutil/pk12util, I get this result:

Brand Thunder                                                u,u,u
Thawte Code Signing CA - Thawte Consulting cc                ,,
thawte                                                       ,,


If I then move all the dylibs for NSS/NSPR into the same directory where
I am running certutil/pk12util, and create a new database and do the
EXACT same steps, I get:

Brand Thunder                                                u,u,u
Thawte Code Signing CA - Thawte Consulting cc                ,,

NO thawte!


If I then move the dylibds back to /opt/local/bin, I get the extra thawte

I verified that if I rename the dylibs in /opt/local/bin, the tools
don't load, so they are definitely using the versions in /opt/local/bin,
not some other version on my system.


So the problem seems to be (figure this one out) that when the NSS/NSPR
libs are in /opt/local/bin, they are getting loaded/run incorrectly.

I'm at a loss.

Mike Kaply
_______________________________________________
dev-tech-crypto mailing list
dev-tech-crypto@...
https://lists.mozilla.org/listinfo/dev-tech-crypto

[mkaply]

Some more test info.

I put everything (dylibs, executables) into usr/local/bin

certutil works
pk12util works (although I get the extra thawte that we talked about
earlier)

signtool fails with:

signtool: function failed: Failure to load dynamic library.
        Unknown error: -2804

if I move all the dylibs into the same directory where I'm running
signtool, signtools works, even with the extra thawte cert.

Something is SERIOUSLY screwed up here.

Mike
_______________________________________________
dev-tech-crypto mailing list
dev-tech-crypto@...
https://lists.mozilla.org/listinfo/dev-tech-crypto

[Julien R Pierre - Sun Microsystems]

Michael,

Michael Kaply wrote:

> Some more test info.
>
> I put everything (dylibs, executables) into usr/local/bin
>
> certutil works
> pk12util works (although I get the extra thawte that we talked about
> earlier)
>
> signtool fails with:
>
> signtool: function failed: Failure to load dynamic library.
>     Unknown error: -2804
>
> if I move all the dylibs into the same directory where I'm running
> signtool, signtools works, even with the extra thawte cert.
>
> Something is SERIOUSLY screwed up here.
>
> Mike

Is this with 3.12 ?

If so, please pull NSS_3_12_1_RTM . A failure to load a dynamic library
in signtool but not other programs could be fixed by bugzilla 438876 .

Good news - I heard yesterday that we will be getting some Mac hardware
for NSS QA within the next month.
_______________________________________________
dev-tech-crypto mailing list
dev-tech-crypto@...
https://lists.mozilla.org/listinfo/dev-tech-crypto