From 42e25d855fa959b7832fbdbc0a384294460d9258 Mon Sep 17 00:00:00 2001 From: Martin Weinelt Date: Tue, 8 Jun 2021 20:29:28 +0200 Subject: [PATCH] firefox: use nss without p11-kit Quickfix to allow firefox to recognize certificates as trusted by Mozilla. Related: #126065 --- pkgs/applications/networking/browsers/firefox/common.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix index e35fd6ca701b..a44fb2032f48 100644 --- a/pkgs/applications/networking/browsers/firefox/common.nix +++ b/pkgs/applications/networking/browsers/firefox/common.nix @@ -116,7 +116,9 @@ let then overrideCC stdenv llvmPackages.clangUseLLVM else stdenv; - nss_pkg = if lib.versionOlder ffversion "83" then nss_3_53 else nss; + # Disable p11-kit support in nss until our cacert packages has caught up exposing CKA_NSS_MOZILLA_CA_POLICY + # https://github.com/NixOS/nixpkgs/issues/126065 + nss_pkg = if lib.versionOlder ffversion "83" then nss_3_53 else nss.override { useP11kit = false; }; # --enable-release adds -ffunction-sections & LTO that require a big amount of # RAM and the 32-bit memory space cannot handle that linking