chore: rely on nss-rs for NSS initialization and test DB (#3621)

larseggert · Copilot · web-flow · commit 70a198541895 · 2026-05-18T11:54:06.000Z
* chore: rely on nss-rs for NSS initialization and test DB

Delegate NSS init in `fixture_init` to `nss-rs`'s own `test-fixture`
crate instead of duplicating the logic. Remove `test-fixture/db` — the
NSS database now comes from `nss-rs`, which exposes `TEST_FIXTURE_DB`
as the default path for `neqo-server --db`. Update CI and scripts
accordingly.

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI &lt;175728472+Copilot@users.noreply.github.com&gt;
Signed-off-by: Lars Eggert &lt;lars@eggert.org&gt;

---------

Signed-off-by: Lars Eggert &lt;lars@eggert.org&gt;
Co-authored-by: Copilot Autofix powered by AI &lt;175728472+Copilot@users.noreply.github.com&gt;
diff --git a/.github/actions/build-neqo/action.yml b/.github/actions/build-neqo/action.yml
@@ -99,7 +99,9 @@ runs:
             cp -L /usr/lib/*/lib${lib}.so* dist/lib/ 2>/dev/null || true
           done
         fi
-        cp -r neqo/test-fixture dist/
+        NSS_DB=$(cd neqo && cargo metadata --format-version 1 | jq -r 'first(.packages[] | select(.name == "test-fixture" and (.source // "" | startswith("git+"))) | .manifest_path | rtrimstr("/Cargo.toml"))')/db
+        mkdir -p dist/test-fixture
+        cp -r "$NSS_DB" dist/test-fixture/
 
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
diff --git a/.github/actions/check-android/action.yml b/.github/actions/check-android/action.yml
@@ -83,7 +83,8 @@ runs:
         while [ -z "$(adb shell getprop sys.boot_completed | tr -d '\r')" ]; do sleep 1; done
         any_failures=0
         TMP=/data/local/tmp
-        [ -e "$WD/test-fixture/db" ] && adb push "test-fixture/db" "$TMP/"
+        NSS_DB=$(cargo metadata --format-version 1 | jq -r 'first(.packages[] | select(.name == "test-fixture" and (.source // "" | startswith("git+"))) | .manifest_path | rtrimstr("/Cargo.toml"))')/db
+        adb push "$NSS_DB" "$TMP/db"
         [ "$LD_LIBRARY_PATH" ] && adb push "$LD_LIBRARY_PATH" "$TMP/"
         for test in $(find $WD/target/$TARGET/debug/deps/ -type f -executable ! -name "*.so" -name "*-*"); do
           adb push "$test" "$TMP/"
diff --git a/.github/scripts/perfcompare.py b/.github/scripts/perfcompare.py
@@ -188,7 +188,8 @@ def verify(cfg, tmp, client, server_cmd, client_cmd):
 def _sudo_nice_env() -> list[str]:
     """Prefix for elevated-priority subprocesses: sudo resets env, so restore
     the vars that neqo binaries need to find NSS libraries and certificates."""
-    env_vars = {k: os.environ[k] for k in ("LD_LIBRARY_PATH", "NSS_DB_PATH") if k in os.environ}
+    # TODO: Remove NSS_DB_PATH once baseline uses nss-rs >= 0.11.0
+    env_vars = {k: os.environ[k] for k in ("LD_LIBRARY_PATH", "TEST_FIXTURE_DB", "NSS_DB_PATH") if k in os.environ}
     env_args = [f"{k}={v}" for k, v in env_vars.items()]
     return ["sudo", "nice", "-n", "-20"] + (["env"] + env_args if env_args else [])
 
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
@@ -97,7 +97,8 @@ jobs:
           cp dist/neqo-baseline/* binaries/neqo-baseline/
           {
             echo "LD_LIBRARY_PATH=$GITHUB_WORKSPACE/dist/lib:$LD_LIBRARY_PATH"
-            echo "NSS_DB_PATH=$GITHUB_WORKSPACE/dist/test-fixture/db"
+            echo "TEST_FIXTURE_DB=$GITHUB_WORKSPACE/dist/test-fixture/db"
+            echo "NSS_DB_PATH=$GITHUB_WORKSPACE/dist/test-fixture/db" # TODO: Remove once baseline uses nss-rs >= 0.11.0
           } >> "$GITHUB_ENV"
 
       # Disable turboboost, hyperthreading, use performance governor, and isolate CPUs with cset.
@@ -111,7 +112,8 @@ jobs:
         env:
           BENCH_SET: ${{ steps.cpu-tuning.outputs.bench-set }}
         run: |
-          bench_exec() { sudo nice -n -20 env "LD_LIBRARY_PATH=$LD_LIBRARY_PATH" "NSS_DB_PATH=$NSS_DB_PATH" setarch --addr-no-randomize cset proc --set="$BENCH_SET" --exec "$@"; }
+          # TODO: Remove NSS_DB_PATH once baseline uses nss-rs >= 0.11.0
+          bench_exec() { sudo nice -n -20 env "LD_LIBRARY_PATH=$LD_LIBRARY_PATH" "TEST_FIXTURE_DB=$TEST_FIXTURE_DB" "NSS_DB_PATH=$NSS_DB_PATH" setarch --addr-no-randomize cset proc --set="$BENCH_SET" --exec "$@"; }
           filter_cset() { grep -v '^cset' || test $? = 1; }
           shopt -s extglob nullglob
 
diff --git a/.github/workflows/perfcompare.yml b/.github/workflows/perfcompare.yml
@@ -173,7 +173,8 @@ jobs:
             build-msquic/* build-google/* build-quiche/* build-s2n/*
           {
             echo "LD_LIBRARY_PATH=$GITHUB_WORKSPACE/build-neqo/lib:$LD_LIBRARY_PATH"
-            echo "NSS_DB_PATH=$GITHUB_WORKSPACE/build-neqo/test-fixture/db"
+            echo "TEST_FIXTURE_DB=$GITHUB_WORKSPACE/build-neqo/test-fixture/db"
+            echo "NSS_DB_PATH=$GITHUB_WORKSPACE/build-neqo/test-fixture/db" # TODO: Remove once baseline uses nss-rs >= 0.11.0
           } >> "$GITHUB_ENV"
 
       # Disable turboboost, hyperthreading, use performance governor, and isolate CPUs with cset.
@@ -189,7 +190,6 @@ jobs:
       - name: Compare QUIC implementations
         env:
           WORKSPACE: ${{ github.workspace }}
-          NSS_DB_PATH: ${{ github.workspace }}/build-neqo/test-fixture/db
           SERVER_SET: ${{ steps.cpu-tuning.outputs.server-set }}
           CLIENT_SET: ${{ steps.cpu-tuning.outputs.client-set }}
         run: |
diff --git a/.github/workflows/profile.yml b/.github/workflows/profile.yml
@@ -82,7 +82,6 @@ jobs:
 
       - name: Run benchmark with perf
         env:
-          NSS_DB_PATH: ${{ github.workspace }}/test-fixture/db
           BENCH: ${{ matrix.bench.bench }}
         run: |
           # shellcheck disable=SC2086
@@ -191,8 +190,6 @@ jobs:
         run: sudo sysctl -w kernel.perf_event_paranoid=-1
 
       - name: Record server perf
-        env:
-          NSS_DB_PATH: ${{ github.workspace }}/test-fixture/db
         run: |
           # shellcheck disable=SC2086
           perf $PERF_OPT -o "$BENCH_NAME.server.perf" -- $SERVER_CMD &
@@ -201,8 +198,6 @@ jobs:
 
       - name: Record client perf
         working-directory: /tmp
-        env:
-          NSS_DB_PATH: ${{ github.workspace }}/test-fixture/db
         run: |
           # shellcheck disable=SC2086
           perf $PERF_OPT -o "$BENCH_NAME.client.perf" -- $CLIENT_CMD || true
diff --git a/AGENTS.md b/AGENTS.md
@@ -144,11 +144,11 @@ cargo test --locked --features ci
 
 3. **Feature flags**: The `ci` feature exists for CI-specific functionality. The `gecko` feature is for Firefox integration (excluded from some checks). The `bench` feature enables benchmarks.
 
-4. **Test utilities**: Use `test-fixture` crate for common test setup (NSS database, connection creation, assertions). NSS_DB_PATH defaults to `test-fixture/db`.
+4. **Test utilities**: Use `test-fixture` crate for common test setup (connection creation, assertions). NSS initialization is handled automatically via `fixture_init()`.
 
 5. **Logging**: Use `RUST_LOG` env var for debug output (e.g., `RUST_LOG=debug`) via the logging macros in `neqo-common/src/log.rs`.
 
-6. **NSS Database**: Tests require NSS database at `test-fixture/db` (committed to repo). Client/server tools can use it with `--db ./test-fixture/db`.
+6. **NSS Database**: Tests use the NSS database from the `nss-rs` dependency automatically. The `neqo-server` binary defaults to this database; override with `--db`.
 
 ## Common Failure Scenarios
 
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -36,7 +36,8 @@ hex = { version = "0.4", default-features = false }
 http = { version = "1", default-features = false, features = ["std"] }
 libc = { version = "0.2", default-features = false }
 log = { version = "0.4", default-features = false }
-nss = { rev = "0.10.0", package = "nss-rs", git = "https://github.com/mozilla/nss-rs" }
+nss = { rev = "0.11.0", package = "nss-rs", git = "https://github.com/mozilla/nss-rs" }
+nss-test-fixture = { rev = "0.11.0", package = "test-fixture", git = "https://github.com/mozilla/nss-rs" }
 qlog = { version = "0.16.0", default-features = false }
 quinn-udp = { version = "0.6", default-features = false, features = ["log", "fast-apple-datapath"] }
 rustc-hash = { version = "2.1", default-features = false, features = [ "std" ]}
diff --git a/README.md b/README.md
@@ -153,7 +153,7 @@ something has changed.
 
 ### Connect with Firefox to local neqo-server
 
-1. Run `neqo-server` via `cargo run --bin neqo-server -- 'localhost:12345' --db ./test-fixture/db`.
+1. Run `neqo-server` via `cargo run --bin neqo-server -- 'localhost:12345'`.
 2. On Firefox, set `about:config` preferences:
    - `network.http.http3.alt-svc-mapping-for-testing` to `localhost;h3=":12345"`
    - `network.http.http3.disable_when_third_party_roots_found` to `false`
diff --git a/neqo-bin/Cargo.toml b/neqo-bin/Cargo.toml
@@ -46,6 +46,7 @@ neqo-http3 = { path = "./../neqo-http3" }
 neqo-transport = { path = "./../neqo-transport" }
 neqo-udp = { path = "./../neqo-udp" }
 nss = { workspace = true }
+nss-test-fixture = { workspace = true }
 qlog = { workspace = true }
 quinn-udp = { workspace = true }
 rustc-hash = { workspace = true }
@@ -58,6 +59,7 @@ criterion = { version = "4", package = "codspeed-criterion-compat", default-feat
         "async_tokio",
 ] }
 neqo-bin = { path = ".", features = ["draft-29"] }
+test-fixture = { path = "../test-fixture" }
 tokio = { version = "1", default-features = false, features = ["sync"] }
 
 [features]
diff --git a/neqo-bin/benches/main.rs b/neqo-bin/benches/main.rs
@@ -10,7 +10,7 @@
     reason = "Inherent in codspeed criterion_group! macro."
 )]
 
-use std::{env, hint::black_box, net::SocketAddr, path::PathBuf, str::FromStr as _};
+use std::{env, hint::black_box, net::SocketAddr};
 
 use criterion::{BatchSize, Criterion, Throughput, criterion_group, criterion_main};
 use neqo_bin::{client, server};
@@ -24,7 +24,7 @@ struct Benchmark {
 }
 
 fn transfer(c: &mut Criterion) {
-    nss::init_db(PathBuf::from_str("../test-fixture/db").unwrap()).unwrap();
+    test_fixture::fixture_init();
 
     let mtu_suffix = env::var("MTU").ok().map(|mtu| format!("/mtu-{mtu}"));
     for Benchmark {
diff --git a/neqo-bin/src/lib.rs b/neqo-bin/src/lib.rs
@@ -295,7 +295,7 @@ fn now() -> Instant {
 #[cfg(test)]
 #[cfg_attr(coverage_nightly, coverage(off))]
 mod tests {
-    use std::{fs, path::PathBuf, str::FromStr as _, time::SystemTime};
+    use std::{fs, path::PathBuf, time::SystemTime};
 
     use crate::{client, server};
 
@@ -331,7 +331,7 @@ mod tests {
 
     #[tokio::test]
     async fn write_qlog_file() {
-        nss::init_db(PathBuf::from_str("../test-fixture/db").unwrap()).unwrap();
+        test_fixture::fixture_init();
 
         let temp_dir = TempDir::new();
 
diff --git a/neqo-bin/src/server/mod.rs b/neqo-bin/src/server/mod.rs
@@ -80,9 +80,9 @@ pub struct Args {
     #[arg(default_value = "[::]:4433")]
     hosts: Vec<String>,
 
-    #[arg(short = 'd', long, default_value = "./test-fixture/db")]
-    /// NSS database directory.
-    db: PathBuf,
+    #[arg(short = 'd', long)]
+    /// NSS database directory [default: `$TEST_FIXTURE_DB` or the bundled NSS test DB].
+    db: Option<PathBuf>,
 
     #[arg(short = 'k', long, default_value = "key")]
     /// Name of key from NSS database.
@@ -102,11 +102,10 @@ pub struct Args {
 #[cfg(any(test, feature = "bench"))]
 impl Default for Args {
     fn default() -> Self {
-        use std::str::FromStr as _;
         Self {
             shared: SharedArgs::default(),
             hosts: vec!["[::]:12345".to_string()],
-            db: PathBuf::from_str("../test-fixture/db").unwrap(),
+            db: None,
             key: "key".to_string(),
             retry: false,
             ech: false,
@@ -542,7 +541,7 @@ pub fn run(
     args.update_for_tests();
     assert!(!args.key.is_empty(), "Need at least one key");
 
-    init_db(args.db.clone())?;
+    init_db(args.db.take().unwrap_or_else(nss_test_fixture::db_path))?;
 
     let hosts = args.listen_addresses();
     if hosts.is_empty() {
diff --git a/test-fixture/Cargo.toml b/test-fixture/Cargo.toml
@@ -21,6 +21,7 @@ neqo-common = { path = "../neqo-common", features = ["test-fixture"] }
 neqo-http3 = { path = "../neqo-http3", features = ["draft-29"] }
 neqo-transport = { path = "../neqo-transport", features = ["draft-29"] }
 nss = { workspace = true }
+nss-test-fixture = { workspace = true }
 qlog = { workspace = true }
 
 [features]
diff --git a/test-fixture/db/cert9.db b/test-fixture/db/cert9.db
diff --git a/test-fixture/db/key4.db b/test-fixture/db/key4.db
diff --git a/test-fixture/db/pkcs11.txt b/test-fixture/db/pkcs11.txt
diff --git a/test-fixture/src/lib.rs b/test-fixture/src/lib.rs
@@ -32,25 +32,13 @@ use neqo_transport::{
     Connection, ConnectionEvent, ConnectionId, ConnectionIdDecoder, ConnectionIdGenerator,
     ConnectionIdRef, ConnectionParameters, State, Version, version,
 };
-use nss::{AllowZeroRtt, AntiReplay, AuthenticationStatus, init_db, random};
+use nss::{AllowZeroRtt, AntiReplay, AuthenticationStatus, random};
 use qlog::{events::EventImportance, streamer::QlogStreamer};
 
 pub mod assertions;
 pub mod header_protection;
 pub mod sim;
 
-/// The path for the database used in tests.
-///
-/// Initialized via the `NSS_DB_PATH` environment variable. If that is not set,
-/// it defaults to the `db` directory in the current crate. If the environment
-/// variable is set to `$ARGV0`, it will be initialized to the directory of the
-/// current executable.
-pub const NSS_DB_PATH: &str = if let Some(dir) = option_env!("NSS_DB_PATH") {
-    dir
-} else {
-    concat!(env!("CARGO_MANIFEST_DIR"), "/db")
-};
-
 /// Initialize the test fixture.  Only call this if you aren't also calling a
 /// fixture function that depends on setup.  Other functions in the fixture
 /// that depend on this setup call the function for you.
@@ -60,14 +48,7 @@ pub const NSS_DB_PATH: &str = if let Some(dir) = option_env!("NSS_DB_PATH") {
 /// When the NSS initialization fails.
 pub fn fixture_init() {
     neqo_common::log::init(None);
-    if NSS_DB_PATH == "$ARGV0" {
-        let mut current_exe = std::env::current_exe().unwrap();
-        current_exe.pop();
-        let nss_db_path = current_exe.to_str().unwrap();
-        init_db(nss_db_path).unwrap();
-    } else {
-        init_db(NSS_DB_PATH).unwrap();
-    }
+    nss_test_fixture::fixture_init();
 }
 
 // This needs to be > 2ms to avoid it being rounded to zero.
diff --git a/test/README.md b/test/README.md
@@ -9,7 +9,7 @@
 1. Start neqo-server
 
    ```shell
-   ./target/release/neqo-server --db ./test-fixture/db
+   ./target/release/neqo-server
    ```
 
 1. Start neqo-client and specify parameters to start the upload test
diff --git a/test/upload_test.sh b/test/upload_test.sh
@@ -9,7 +9,7 @@ server_port=4433
 upload_size=8388608
 cc=cubic
 client="cargo run --release --bin neqo-client -- http://$server_address:$server_port/ --test upload --upload-size $upload_size --cc $cc"
-server="cargo run --release --bin neqo-server -- --db ../test-fixture/db $server_address:$server_port"
+server="cargo run --release --bin neqo-server -- $server_address:$server_port"
 server_pid=0
 no_pacing=false
 if [ "$no_pacing" = true ]; then
