#1128698 nss: FTBFS with glibc 2.43 due to ISO C23 const return types

Package:
src:nss
Source:
src:nss
Submitter:
Aurelien Jarno
Date:
2026-02-22 14:51:06 UTC
Severity:
normal
Tags:
#1128698#5
Date:
2026-02-22 14:49:24 UTC
From:
To:
Dear maintainer(s),

nss fails to build from source with glibc 2.43, currently in
experimental. From the build log:

| cc -o OBJS/Linux_SINGLE_SHLIB/lowhash_vector.o -c -std=c99 -g -O2 -Werror=implicit-function-declaration -ffile-prefix-map=/build/reproducible-path/nss-3.120=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -mbranch-protection=standard -Wall -pipe -Wdate-time -D_FORTIFY_SOURCE=2 -fPIC   -pipe -ffunction-sections -fdata-sections -DHAVE_STRERROR -Wall -Wshadow -Werror -DXP_UNIX -DXP_UNIX -UDEBUG -DNDEBUG -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -DSDB_MEASURE_USE_TEMP_DIR -D_REENTRANT -DSHLIB_SUFFIX=\"so\" -DSHLIB_PREFIX=\"lib\" -DSHLIB_VERSION=\"3\" -DSOFTOKEN_SHLIB_VERSION=\"3\" -DKYBER_K=3 -DRIJNDAEL_INCLUDE_TABLES -UDEBUG -DNDEBUG -D_DEFAULT_SOURCE -D_BSD_SOURCE -D_POSIX_SOURCE -DSDB_MEASURE_USE_TEMP_DIR -D_REENTRANT -DNSS_DISABLE_AVX2 -DNSS_DISABLE_SSE3 -DNSS_NO_INIT_SUPPORT -DUSE_UTIL_DIRECTLY -DNO_NSPR_10_SUPPORT -DSSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -DNSS_USE_64 -DFREEBL_NO_DEPEND -DFREEBL_LOWHASH -DUSE_HW_AES -DUSE_HW_SHA1 -DUSE_HW_SHA2 -DHAVE_INT128_SUPPORT -DKRML_MUSTINLINE=inline -DMP_API_COMPATIBLE -I/usr/include/nspr -I/build/reproducible-path/nss-3.120/dist/include -I/build/reproducible-path/nss-3.120/dist/public/nss -I/build/reproducible-path/nss-3.120/dist/private/nss -Impi -Iecl -Iverified -Iverified/internal -Iverified/karamel/include -Iverified/karamel/krmllib/dist/minimal -Iverified/eurydice -Ideprecated  lowhash_vector.c
| In file included from lowhash_vector.c:65:
| genload.c: In function ‘loader_LoadLibInReferenceDir’:
| genload.c:92:7: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
|    92 |     c = strrchr(referencePath, PR_GetDirectorySeparator());
|       |       ^
| cc1: all warnings being treated as errors
| make[6]: *** [../../coreconf/rules.mk:286: OBJS/Linux_SINGLE_SHLIB/lowhash_vector.o] Error 1
| make[6]: Leaving directory '/build/reproducible-path/nss-3.120/nss/lib/freebl'
| make[5]: *** [Makefile:711: freebl_NEED_STUB_BUILD] Error 2
| make[5]: Leaving directory '/build/reproducible-path/nss-3.120/nss/lib/freebl'
| make[4]: *** [../coreconf/rules.mk:44: freebl] Error 2
| make[4]: Leaving directory '/build/reproducible-path/nss-3.120/nss/lib'
| make[3]: *** [coreconf/rules.mk:44: lib] Error 2
| make[3]: Leaving directory '/build/reproducible-path/nss-3.120/nss'
| make[2]: *** [manifest.mn:21: all] Error 2
| make[2]: Leaving directory '/build/reproducible-path/nss-3.120/nss'
| make[1]: *** [debian/rules:112: override_dh_auto_build] Error 2
| make[1]: Leaving directory '/build/reproducible-path/nss-3.120'
| make: *** [debian/rules:197: binary] Error 2
| dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2

The full build log is available here [1].

The issue is due to ISO C23 declaration of bsearch, memchr, strchr,
strpbrk, strrchr, strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr,
which now returns a pointer to a const-qualified type when the input
argument is a pointer to a const-qualified type [2].

I would like to thanks Emanuele Rocca for doing the archive rebuild on
a fast arm64 server.

Regards
Aurelien

[1] https://people.debian.org/~ema/glibc-2.43-rebuilds/output-1/nss_arm64.build
[2] https://sourceware.org/git/?p=glibc.git;a=blob;f=NEWS;h=e271fb2e4d76903c77a302aaec1ca22ce31027d0;hb=f762ccf84f122d1354f103a151cba8bde797d521#l19