#889698 nss 3.35 now defaults to SQL database, broke certmonger/mod_nss/dogtag/freeipa

Package:
nss
Source:
nss
Submitter:
Timo Aaltonen
Date:
2018-12-01 22:36:13 UTC
Severity:
normal
#889698#5
Date:
2018-02-06 07:16:05 UTC
From:
To:
Hi, please revert this commit which switched the default certificate database format to SQL:

https://github.com/nss-dev/nss/commit/33b114e38278c4ffbb6b244a0ebc9910e5245cd3

Several packages are not ready for it yet, including but likely not limited to:

certmonger
libapache2-mod-nss
dogtag-pki
freeipa

respective upstreams are working on it but getting everything merged will take a month or two.
#889698#12
Date:
2018-02-06 08:33:36 UTC
From:
To:
Can you be more specific in how this affects those packages? Because
AFAIR, this is supposed to kind of be transparent.

Mike
#889698#17
Date:
2018-02-06 10:15:50 UTC
From:
To:
For example it changes how certutil is run, which would now need a
'dbm:'(?) prefix when accessing an old DB like when setting up Freeipa
as shown here:

https://bugs.launchpad.net/bugs/1746947

and it also breaks an installed Dogtag instance though I don't know how
exactly:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889526

these all use an internal cert DB.
#889698#22
Date:
2018-12-01 22:28:33 UTC
From:
To:
Hi Timo,

On Tue, 6 Feb 2018 12:15:50 +0200 Timo Aaltonen <tjaalton@debian.org> wrote:
[...]

I have tried to reproduce the bug and I couldn't. That's the reason I'm
changing the severity. Could you provide more information about how to
reproduce this bug please?

Cheers,