How do I build python-nss and NSS for Mac OS X?

I'm trying to build python-nss, a python interface for the Mozilla NSS library, on a 64-bit Mac running Mac OS 10.6.5, for use in python software running on Mac OS X 10.6 or later. I can get NSS itself to build successfully, using certain options, but the python-nss build gives several warnings, and the resulting Python module isn't usable.

To build NSS, I'm following these instructions, but using this NSS source code, rather than a checkout from cvs. If I just run make nss_build_all, I encounter an error:

ncraike@ncraikework ~/Installs/nss-3.12.9/mozilla/security/nss
$ make nss_build_all
...
drbg.c: In function ‘RNG_RandomUpdate’:
drbg.c:516: error: size of array ‘arg’ is negative
make[3]: *** [Darwin10.5.0_DBG.OBJ/Darwin_SINGLE_SHLIB/drbg.o] Error 1
make[2]: *** [libs] Error 2
make[1]: *** [libs] Error 2
make: *** [libs] Error 2

The line in question (line 516 of mozilla/security/nss/lib/freebl/drbg.c) is an assertion that a particular type is of an expected size:

    PR_STATIC_ASSERT(sizeof(size_t) <= 4);

If I write a quick test program, sizeof(size_t) seems to be 8, so perhaps the 64-bit version is being built, despite this on the above instructions page:

On Unix platforms, except Alpha/OSF1, if you want a build for the system's 64-bit ABI, set USE_64=1 in your environment. By default, NSS builds for the 32-bit environment on all platforms except Alpha/OSF1.

Adding the gcc option -arch i386 (suggested for a similar issue) doesn't help, but building with the USE_64 environment variable is successful (although a 64-bit build may not be what I need):

ncraike@ncraikework ~/Installs/nss-3.12.9/mozilla/security/nss
$ USE_64=1 make nss_build_all

This may be fine, but problems occur when I try to build python-nss (using this source).

Some modifications to python-nss's setup.py are needed to include the NSS libraries just built. The original setup.py hard-codes the include directories for each extension, for example:

nss_nss_extension = \
    Extension('nss.nss',
              sources            = ['src/py_nss.c'],
              include_dirs       = ['src', '/usr/include/nss3', '/usr/include/nspr4'],
              libraries          = ['nspr4', 'ssl3', 'nss3'],
              extra_compile_args = extra_compile_args,
              )

So I've modified the extension declarations by adding these lines:

DIST_ROOT = '/Users/ncraike/Installs/nss-3.12.9/mozilla/dist/'
INCLUDE_DIRS = [DIST_ROOT+'Darwin10.5.0_64_DBG.OBJ/include', DIST_ROOT+'public/nss/', DIST_ROOT+'private/nss/']
LIB_DIRS = [DIST_ROOT+'Darwin10.5.0_64_DBG.OBJ/lib/']

...and changing each extension to add an INCLUDE_DIRS list and include a library_dirs argument (as described in the distutils documentation). For example:

nss_nss_extension = \
    Extension('nss.nss',
              sources            = ['src/py_nss.c'],
              include_dirs       = ['src'] + INCLUDE_DIRS,
              libraries          = ['nspr4', 'ssl3', 'nss3'],
              library_dirs       = LIB_DIRS,
              extra_compile_args = extra_compile_args,
              )

After these changes, python setup.py build runs and seems to be aware of the NSS libraries, but produces several warnings, including:

src/py_nss.c:12640: warning: format ‘%d’ expects type ‘int’, but argument 2 has type ‘Py_ssize_t’
gcc-4.2 -Wl,-F. -bundle -undefined dynamic_lookup -arch i386 -arch ppc -arch x86_64 build/temp.macosx-10.6-universal-2.6/src/py_nss.o -L/Users/ncraike/Installs/nss-3.12.9/mozilla/dist/Darwin10.5.0_64_DBG.OBJ/lib/ -lnspr4 -lssl3 -lnss3 -o build/lib.macosx-10.6-universal-2.6/nss/nss.so
ld: warning: in build/temp.macosx-10.6-universal-2.6/src/py_nss.o, file was built for unsupported file format which is not the architecture being linked (i386)
ld: warning: in /Users/ncraike/Installs/nss-3.12.9/mozilla/dist/Darwin10.5.0_64_DBG.OBJ/lib//libnspr4.dylib, file was built for unsupported file format which is not the architecture being linked (i386)
ld: warning: in /Users/ncraike/Installs/nss-3.12.9/mozilla/dist/Darwin10.5.0_64_DBG.OBJ/lib//libssl3.dylib, file was built for unsupported file format which is not the architecture being linked (i386)

"file was built for unsupported file format which is not the architecture being linked" is the most common warning. This error is mentioned in a post on another site, with a possible solution of using the -arch i386 option with gcc. I'm not sure at what step in the build process to add this option (NSS or python-nss?), and how I might add it to the python distutils build script.

The build does complete, but the resulting python module doesn't seem usable:

ncraike@ncraikework ~/Installs/python-nss-0.10/build/lib.macosx-10.6-universal-2.6
$ ls
nss
ncraike@ncraikework ~/Installs/python-nss-0.10/build/lib.macosx-10.6-universal-2.6
开发者_运维技巧$ python
Python 2.6.1 (r261:67515, Jun 24 2010, 21:47:49) 
[GCC 4.2.1 (Apple Inc. build 5646)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import nss.nss
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: dlopen(nss/nss.so, 2): Library not loaded: @executable_path/libssl3.dylib
  Referenced from: /Users/ncraike/Installs/python-nss-0.10/build/lib.macosx-10.6-universal-2.6/nss/nss.so
  Reason: image not found

Is my error in how I'm building NSS or how I'm building python-nss? How should I be telling the python-nss build script to link with the Mac OS X NSS libraries correctly? I have much more python experience than C experience, so if I've made some simple building error I won't be surprised.

I'm running Mac OS 10.6.5, with Xcode 3.2.4 (64-bit) installed. gcc -v gives gcc version 4.2.1 (Apple Inc. build 5664) and Target: i686-apple-darwin10.

Thanks.

In OSX 10.7 we have llvm-gcc and llvm-g++ by default. They usually print out more verbal error messages.

cc -o Darwin11.3.0_DBG.OBJ/Darwin_SINGLE_SHLIB/drbg.o -c -g -fPIC -Di386 -Wmost -fpascal-strings -fno-common -pipe -DDARWIN -DHAVE_STRERROR -DHAVE_BSD_FLOCK  -DXP_UNIX -DSHLIB_SUFFIX=\"dylib\" -DSHLIB_PREFIX=\"lib\" -DSHLIB_VERSION=\"3\" -DSOFTOKEN_SHLIB_VERSION=\"3\" -DRIJNDAEL_INCLUDE_TABLES -DDEBUG -UNDEBUG -DDEBUG_antkong -DUSE_UTIL_DIRECTLY -DMP_API_COMPATIBLE -I../../../../dist/Darwin11.3.0_DBG.OBJ/include -I../../../../dist/public/nss -I../../../../dist/private/nss -Impi -Iecl  drbg.c
drbg.c:471:34: warning: implicit conversion from enumeration type 'PRStatus' to different enumeration type 'SECStatus' (aka 'enum _SECStatus') [-Wconversion]
    return (globalrng != NULL) ? PR_SUCCESS : PR_FAILURE;
                               ~ ^~~~~~~~~~
drbg.c:471:47: warning: implicit conversion from enumeration type 'PRStatus' to different enumeration type 'SECStatus' (aka 'enum _SECStatus') [-Wconversion]
    return (globalrng != NULL) ? PR_SUCCESS : PR_FAILURE;
                               ~              ^~~~~~~~~~
drbg.c:516:5: error: 'arg' declared as an array with a negative size
    PR_STATIC_ASSERT(sizeof(size_t) <= 4);
    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
../../../../dist/Darwin11.3.0_DBG.OBJ/include/prtypes.h:528:42: note: expanded from macro 'PR_STATIC_ASSERT'
    extern void pr_static_assert(int arg[(condition) ? 1 : -1])
                                         ^~~~~~~~~~~~~~~~~~~~
2 warnings and 1 error generated.

Hopefully they may help you to find a solution or file a bug report with Mozilla NSS project