openjdk team mailing list archive

[Matthias Klose <matthias.klose@xxxxxxxxxxxxx>]

Public bug reported:

Binary package hint: firefox

starting with openjdk/icedtea-1.7, a NSS based security provider is
supported by icedtea.

The firefox start script in MOZILLA_FIVE_HOME sets LD_LIBRARY_PATH to
include MOZILLA_FIVE_HOME and a number of subdirectories of
MOZILLA_FIVE_HOME. The current NSS provider code seems to honor
LD_LIBRARY_PATH, and loads the libnss3.so provided by the browser.

Caused by: java.io.IOException: An incompatible version of NSS is already loaded, 3.7 or later required
        at sun.security.pkcs11.Secmod.isInitialized(Secmod.java:130)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:168)

(wondering why the nss version shipped with firefox 3.6.3 identifies
itself as 3.7).

However the openjdk build is configured for the nss version configured
at build time, and you can run it with more than one browser, so it
makes sense to use the libnss version which was detected at openjdk
build time.

My current solution/workaround is to pass a modified LD_LIBRARY_PATH to
the subprocess such that the libnss3.so which was configured at build
time is always used.

The setting of LD_LIBRARY_PATH in the run-mozilla.sh start script may be
convenient, but it does break plugins which are built to be independent
of the browser used.

Things to do on the browser side:

 - why does firefox use it's own outdated libnss copy, and doesn't use the system nss3?
 - why does the nss shipped with firefox identifies itself with 3.7?
 - the firefox startup script should not set LD_LIBRARY_PATH, but search itself for libs
   in known places.

for a proposed workaround for the icedtea6-plugin to work with this
broken plugin, see
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=461

** Affects: openjdk
     Importance: Unknown
         Status: Unknown

** Affects: firefox (Ubuntu)
     Importance: High
         Status: Triaged

** Affects: openjdk-6 (Ubuntu)
     Importance: High
         Status: In Progress

** Affects: firefox (Ubuntu Lucid)
     Importance: High
         Status: Triaged

** Affects: openjdk-6 (Ubuntu Lucid)
     Importance: High
         Status: In Progress

** Changed in: firefox (Ubuntu)
   Importance: Undecided => High

** Changed in: firefox (Ubuntu)
       Status: New => Triaged

** Changed in: firefox (Ubuntu)
    Milestone: None => ubuntu-10.04

** Also affects: openjdk-6 (Ubuntu)
   Importance: Undecided
       Status: New

** Changed in: openjdk-6 (Ubuntu)
   Importance: Undecided => High

** Changed in: openjdk-6 (Ubuntu)
       Status: New => In Progress

** Changed in: openjdk-6 (Ubuntu)
    Milestone: None => ubuntu-10.04

** Also affects: firefox (Ubuntu Lucid)
   Importance: High
       Status: Triaged

** Also affects: openjdk-6 (Ubuntu Lucid)
   Importance: High
       Status: In Progress

-- 
firefox sets LD_LIBRARY_PATH which breaks the icedtea6-plugin
https://bugs.launchpad.net/bugs/561124
You received this bug notification because you are a member of OpenJDK,
which is subscribed to openjdk-6 in ubuntu.

Status in OpenJDK: Unknown
Status in “firefox” package in Ubuntu: Triaged
Status in “openjdk-6” package in Ubuntu: In Progress
Status in “firefox” source package in Lucid: Triaged
Status in “openjdk-6” source package in Lucid: In Progress

Bug description:
Binary package hint: firefox

starting with openjdk/icedtea-1.7, a NSS based security provider is supported by icedtea.

The firefox start script in MOZILLA_FIVE_HOME sets LD_LIBRARY_PATH to include MOZILLA_FIVE_HOME and a number of subdirectories of MOZILLA_FIVE_HOME. The current NSS provider code seems to honor LD_LIBRARY_PATH, and loads the libnss3.so provided by the browser.

Caused by: java.io.IOException: An incompatible version of NSS is already loaded, 3.7 or later required
        at sun.security.pkcs11.Secmod.isInitialized(Secmod.java:130)
        at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:168)

(wondering why the nss version shipped with firefox 3.6.3 identifies itself as 3.7).

However the openjdk build is configured for the nss version configured at build time, and you can run it with more than one browser, so it makes sense to use the libnss version which was detected at openjdk build time.

My current solution/workaround is to pass a modified LD_LIBRARY_PATH to the subprocess such that the libnss3.so which was configured at build time is always used.

The setting of LD_LIBRARY_PATH in the run-mozilla.sh start script may be convenient, but it does break plugins which are built to be independent of the browser used.

Things to do on the browser side:

 - why does firefox use it's own outdated libnss copy, and doesn't use the system nss3?
 - why does the nss shipped with firefox identifies itself with 3.7?
 - the firefox startup script should not set LD_LIBRARY_PATH, but search itself for libs
   in known places.

for a proposed workaround for the icedtea6-plugin to work with this broken plugin, see http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=461