@@ -2,9 +2,6 @@ name: Install NSS
22description : Install NSS
33
44inputs :
5- type :
6- description : " When building, whether to do a debug or release build of NSS"
7- default : " Release"
85 minimum-version :
96 description : " Minimum required version of NSS"
107 required : true
@@ -17,16 +14,16 @@ runs:
1714 steps :
1815 - name : Install system NSS (Linux)
1916 shell : bash
20- if : ${{ runner.os == 'Linux' && runner.environment == 'github-hosted ' && inputs.target == '' }}
17+ if : ${{ runner.os == 'Linux' && inputs.target == '' && (runner.environment != 'self-hosted' || contains(runner.name, 'CodSpeed')) }}
2118 env :
2219 DEBIAN_FRONTEND : noninteractive
2320 run : |
2421 [ "$APT_UPDATED" ] || sudo apt-get update && echo "APT_UPDATED=1" >> "$GITHUB_ENV"
25- sudo apt-get install -y --no-install-recommends libnss3-dev pkg-config
22+ sudo apt-get install -y --no-install-recommends libnss3-dev
2623
2724name : Install system NSS (MacOS)
2825 shell : bash
29- if : ${{ runner.os == 'MacOS' && runner.environment == 'github-hosted' && inputs.target == '' }}
26+ if : ${{ runner.os == 'MacOS' && inputs.target == '' }}
3027 run : |
3128 [ "$BREW_UPDATED" ] || brew update && echo "BREW_UPDATED=1" >> "$GITHUB_ENV"
3229 brew install nss
3835 shell : bash
3936 if : inputs.target == ''
4037 run : |
41- if ! command -v pkg-config &> /dev/null; then
42- echo "pkg-config: not found"
43- exit 0
44- fi
45- if ! pkg-config --exists nss; then
46- echo "pkg-config: NSS not found"
47- exit 0
48- fi
49- NSS_VERSION="$(pkg-config --modversion nss)"
50- if [ "$?" -ne 0 ]; then
51- echo "pkg-config: failed to determine NSS version"
52- exit 0
53- fi
54- NSS_MAJOR=$(echo "$NSS_VERSION" | cut -d. -f1)
55- NSS_MINOR=$(echo "$NSS_VERSION" | cut -d. -f2)
56- REQ_NSS_MAJOR=$(echo "$MIN_VERSION" | cut -d. -f1)
57- REQ_NSS_MINOR=$(echo "$MIN_VERSION" | cut -d. -f2)
58- if [[ "$NSS_MAJOR" -lt "$REQ_NSS_MAJOR" || "$NSS_MAJOR" -eq "$REQ_NSS_MAJOR" && "$NSS_MINOR" -lt "$REQ_NSS_MINOR" ]]; then
59- echo "System NSS is too old: $NSS_VERSION"
38+ if ! pkg-config --atleast-version "$MIN_VERSION" nss; then
39+ echo -n "System NSS needs ${MIN_VERSION}, got "
40+ pkg-config --modversion nss 2>/dev/null || echo "pkg-config error"
6041 exit 0
6142 fi
6243 echo "System NSS is suitable: $NSS_VERSION"
@@ -69,11 +50,11 @@ runs:
6950 #
7051 # Also, only enable sscache on our self-hosted runner, because the GitHub cache limit
7152 # is too small for this to be effective there.
72- if : ${{ env.SCCACHE_ENABLED != '1' && !steps.system_nss.outputs.suitable && runner.environment != 'github -hosted' }}
73- uses : mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd # v0.0.4
53+ if : ${{ env.SCCACHE_ENABLED != '1' && !steps.system_nss.outputs.suitable && runner.environment == 'self -hosted' && !contains(runner.name, 'CodSpeed') }}
54+ uses : mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
7455
7556 - name : Enable sscache
76- if : ${{ !steps.system_nss.outputs.suitable && runner.environment != 'github -hosted' }}
57+ if : ${{ !steps.system_nss.outputs.suitable && runner.environment == 'self -hosted' && !contains(runner.name, 'CodSpeed') }}
7758 env :
7859 RUNNER_ENVIRONMENT : ${{ runner.environment }}
7960 RUNNER_OS : ${{ runner.os }}
@@ -87,54 +68,61 @@ runs:
8768 fi
8869 echo "CMAKE_C_COMPILER_LAUNCHER=sccache" >> "$GITHUB_ENV"
8970 echo "CMAKE_CXX_COMPILER_LAUNCHER=sccache" >> "$GITHUB_ENV"
90- if [ "$RUNNER_ENVIRONMENT" == "github-hosted" ]; then
91- echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
92- fi
71+ echo "SCCACHE_GHA_ENABLED=true" >> "$GITHUB_ENV"
9372
94- name : Checkout NSS
73+ name : Retrieve NSS
74+ id : nss
9575 if : ${{ !steps.system_nss.outputs.suitable }}
96- uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
97- with :
98- repository : nss-dev/nss
99- path : nss
100- persist-credentials : false
76+ shell : bash
77+ env :
78+ NSS_VERSION : " 3.120" # TODO: Bump this periodically; also in qns/Dockerfile. Trailing zeroes are stripped w/o quotes!
79+ run : |
80+ NSS_TAG="${NSS_VERSION//./_}"
81+ NSS_URL="https://ftp.mozilla.org/pub/security/nss/releases/NSS_${NSS_TAG}_RTM/src/nss-${NSS_VERSION}.tar.gz"
82+ echo "Retrieving NSS $NSS_VERSION from $NSS_URL"
83+ curl -L "$NSS_URL" | tar xz --strip-components=1
84+ echo "version=$NSS_VERSION" >> "$GITHUB_OUTPUT"
10185
10286name : Retrieve NSPR
10387 id : nspr
10488 if : ${{ !steps.system_nss.outputs.suitable }}
10589 shell : bash
10690 env :
107- NSPR_VERSION : 4.37 # This changes so rarely that we can hardcode it.
91+ NSPR_VERSION : " 4.38.2 " # TODO: Bump this periodically; also in qns/Dockerfile. Trailing zeroes are stripped w/o quotes!
10892 run : |
109- curl -L https://ftp.mozilla.org/pub/nspr/releases/v$NSPR_VERSION/src/nspr-$NSPR_VERSION.tar.gz |
110- tar xz --strip-components=1
93+ NSPR_URL="https://ftp.mozilla.org/pub/nspr/releases/v$NSPR_VERSION/src/nspr-$NSPR_VERSION.tar.gz"
94+ echo "Retrieving NSPR $NSPR_VERSION from $NSPR_URL"
95+ curl -L "$NSPR_URL" | tar xz --strip-components=1
11196 echo "version=$NSPR_VERSION" >> "$GITHUB_OUTPUT"
11297
113- name : Store NSS version
114- id : nss
115- if : ${{ !steps.system_nss.outputs.suitable }}
98+ name : Store Ubuntu release code name (Linux)
99+ id : ubuntu_release
116100 shell : bash
101+ if : ${{ runner.os == 'Linux' && !steps.system_nss.outputs.suitable }}
117102 run : |
118- NSS_HEAD=$(git -C nss rev-parse HEAD)
119- echo "version=$NSS_HEAD" >> "$GITHUB_OUTPUT"
120-
121- name : Cache NSS
103+ # Store Ubuntu release codename for use in cache key.
104+ . /etc/os-release
105+ echo "codename=-$UBUNTU_CODENAME" >> "$GITHUB_OUTPUT"
106+
107+ # Use restore-only here so PRs don't create redundant caches. PRs restore
108+ # from main; only main saves new caches. This reduces churn and evictions.
109+ # Downside: PRs that change NSS version/build will rebuild on every CI run.
110+ - name : Restore NSS cache
122111 id : cache
123- if : ${{ !steps.system_nss.outputs.suitable && runner.environment == 'github-hosted' }}
124- uses : actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
112+ if : ${{ !steps.system_nss.outputs.suitable }}
113+ uses : actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
125114 with :
126115 path : dist
127- key : nss-${{ inputs.target && inputs.target || runner.os }}- ${{ runner.arch }}-${{ inputs.type }}-${{ steps.nss.outputs.version }}-${{ steps.nspr.outputs.version }}
116+ key : nss-${{ inputs.target || runner.os }}${{ steps.ubuntu_release.outputs.codename }}-${{ runner.arch }}-${{ steps.nss.outputs.version }}-${{ steps.nspr.outputs.version }}
128117
129118 - name : Check if build is needed
130119 id : check_build
131120 if : ${{ !steps.system_nss.outputs.suitable }}
132121 env :
133122 CACHE_HIT : ${{ steps.cache.outputs.cache-hit }}
134- RUNNER_ENVIRONMENT : ${{ runner.environment }}
135123 shell : bash
136124 run : |
137- if [ "$RUNNER_ENVIRONMENT " != "github-hosted" ] || [ ! "$CACHE_HIT " ]; then
125+ if [ "$CACHE_HIT " != "true " ]; then
138126 echo "Building NSS from source"
139127 echo "build_nss=1" >> "$GITHUB_OUTPUT"
140128 else
@@ -143,7 +131,7 @@ runs:
143131
144132name : Install build dependencies (Linux)
145133 shell : bash
146- if : ${{ runner.os == 'Linux' && steps.check_build.outputs.build_nss && runner.environment == 'github -hosted' }}
134+ if : ${{ runner.os == 'Linux' && steps.check_build.outputs.build_nss && ( runner.environment != 'self -hosted' || contains(runner.name, 'CodSpeed')) }}
147135 env :
148136 DEBIAN_FRONTEND : noninteractive
149137 run : sudo apt-get install -y --no-install-recommends gyp ninja-build
@@ -191,17 +179,14 @@ runs:
191179 shell : bash
192180 if : ${{ !steps.system_nss.outputs.suitable }}
193181 env :
194- NSS_TARGET : ${{ inputs.type }}
195- NSS_TYPE : ${{ inputs.type }}
196182 NSS_DIR : ${{ github.workspace }}/nss
197183 RUNNER_OS : ${{ runner.os }}
198184 WORKSPACE : ${{ github.workspace }}
199185 run : | # zizmor: ignore[github-env] We need to write to GITHUB_PATH on Windows.
200- NSS_OUT="$WORKSPACE/dist/$NSS_TARGET "
186+ NSS_OUT="$WORKSPACE/dist/Release "
201187 {
202188 echo "LD_LIBRARY_PATH=$NSS_OUT/lib"
203189 echo "DYLD_FALLBACK_LIBRARY_PATH=$NSS_OUT/lib"
204- echo "NSS_TARGET=$NSS_TARGET"
205190 echo "NSS_DIR=$NSS_DIR"
206191 echo "NSS_PREBUILT=1"
207192 } >> "$GITHUB_ENV"
@@ -216,13 +201,10 @@ runs:
216201 TARGET_PLATFORM : ${{ inputs.target }}
217202 RUNNER_OS : ${{ runner.os }}
218203 run : |
219- if [ "$NSS_TARGET" != "Debug" ]; then
220- # We want to do an optimized build for accurate CPU profiling, but
221- # we also want debug symbols and frame pointers for that, which the normal optimized NSS
222- # build process doesn't provide.
223- OPT="-o"
224- [ "$RUNNER_OS" != "Windows" ] && export CFLAGS="-ggdb3 -fno-omit-frame-pointer"
225- fi
204+ # We want to do an optimized build for accurate CPU profiling, but
205+ # we also want debug symbols and frame pointers for that, which the normal optimized NSS
206+ # build process doesn't provide.
207+ [ "$RUNNER_OS" != "Windows" ] && export CFLAGS="-ggdb3 -fno-omit-frame-pointer"
226208 if [[ $TARGET_PLATFORM == *-android* ]]; then
227209 for file in build-nss-android.sh build-android-common.sh; do
228210 curl -o "$file" -sSf "https://raw.githubusercontent.com/mozilla/application-services/refs/tags/v137.0/libs/$file"
@@ -238,12 +220,12 @@ runs:
238220 find /tmp/tmp.* > tmp
239221 CERTUTIL="$(grep certutil tmp)"
240222 TARGET_DIR="$(dirname $(dirname $CERTUTIL))"
241- mkdir -p "dist/$NSS_TARGET "
242- cp -vaL "$TARGET_DIR"/* "dist/$NSS_TARGET /"
223+ mkdir -p "dist/Release "
224+ cp -vaL "$TARGET_DIR"/* "dist/Release /"
243225 NSPR_H="$(grep nspr.h tmp)"
244226 INCLUDE_DIR="$(dirname $NSPR_H)"
245- mkdir -p "dist/$NSS_TARGET /include/nspr"
246- cp -vaL "$INCLUDE_DIR"/* "dist/$NSS_TARGET /include/nspr"
227+ mkdir -p "dist/Release /include/nspr"
228+ cp -vaL "$INCLUDE_DIR"/* "dist/Release /include/nspr"
247229 CHACHA="$(grep chacha20poly1305.h tmp)"
248230 PRIVATE_DIR="$(dirname $(dirname $CHACHA))"
249231 mkdir -p "dist/private"
@@ -254,9 +236,16 @@ runs:
254236 cp -vaL "$PUBLIC_DIR"/* "dist/"
255237 LIBNSPR4="$(grep lib/libnspr4.a tmp)"
256238 LIB_DIR="$(dirname $LIBNSPR4)"
257- mkdir -p "dist/$NSS_TARGET /lib"
258- cp -vaL "$LIB_DIR"/* "dist/$NSS_TARGET /lib"
239+ mkdir -p "dist/Release /lib"
240+ cp -vaL "$LIB_DIR"/* "dist/Release /lib"
259241 else
260242 [ "$SCCACHE_CC" ] && [ "$SCCACHE_CXX" ] && export CC="$SCCACHE_CC" CXX="$SCCACHE_CXX"
261- $NSS_DIR/build.sh -g -Ddisable_tests=1 -Ddisable_dbm=1 -Ddisable_libpkix=1 -Ddisable_ckbi=1 -Ddisable_fips=1 $OPT --static
243+ $NSS_DIR/build.sh -g -Ddisable_tests=1 -Ddisable_dbm=1 -Ddisable_libpkix=1 -Ddisable_ckbi=1 -Ddisable_fips=1 --opt --static
262244 fi
245+
246+ name : Save NSS cache
247+ if : ${{ steps.check_build.outputs.build_nss && github.event_name != 'pull_request' }}
248+ uses : actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
249+ with :
250+ path : dist
251+ key : nss-${{ inputs.target || runner.os }}${{ steps.ubuntu_release.outputs.codename }}-${{ runner.arch }}-${{ steps.nss.outputs.version }}-${{ steps.nspr.outputs.version }}
0 commit comments