Use PK11_CreatePrivateKeyFromTemplate instead of the CreateGenericObject/FindKeyByKeyID workaround - #7456
Open
Frosne wants to merge 4 commits into
Open
Conversation
Frosne
force-pushed
the
rc_crypto-create-private-key-from-template
branch
from
August 18, 2026 16:38
7049523 to
b0aaf87
Compare
…ect/FindKeyByKeyID workaround
Frosne
force-pushed
the
rc_crypto-create-private-key-from-template
branch
from
August 18, 2026 16:41
b0aaf87 to
79c8b8a
Compare
Frosne
marked this pull request as ready for review
August 18, 2026 16:46
PK11_CreatePrivateKeyFromTemplate was added in NSS 3.126, but libs/ pinned 3.125. Rust does not check extern "C" declarations against real symbols, so rc_crypto built fine and only failed at link time with "undefined symbol: PK11_CreatePrivateKeyFromTemplate". Same NSPR (4.39), so this is a drop-in bump. Both CI caches key on libs/ contents, so they invalidate on their own. Note: this does not cover macOS, which does not build NSS from source but pulls a prebuilt dist pinned in taskcluster/kinds/fetch/kind.yml and libs/build-nss-desktop.sh. That artifact is still NSS 3.125 and needs rebuilding from 3.126+ separately.
Frosne
force-pushed
the
rc_crypto-create-private-key-from-template
branch
from
August 20, 2026 09:19
f80a632 to
ec76214
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This patch replaces the PK11_CreateGenericObject/PK11_FindKeyByKeyID workaround in rc_crypto with a direct call to PK11_CreatePrivateKeyFromTemplate.
This requires NSS 3.126 or newer, so the pinned NSS version needs to be updated -- I got libs/build-all.sh bumped to 3.126 here, but I was not sure how to do it for mac.
No breaking change. The only consumer-facing change is the minimum NSS version, now 3.126.
[ci full]to the PR title.Builds and automation/tests.py rust-tests pass on Linux. Btw, I'd like it someone helped me to make sure it works on MacOS.
No new test. The patch already contains tests testing the existing functionality (for example, test_compute_public_key_known_values)
Nothing, the previous NSS bumps did not require any.
NSS 3.125 → 3.126 only.