Building NSS on Windows

Preamble

NSS stands for ​Network Security Services. NSS is required to use SSL in Pidgin. NSS depends on NSPR and a shared database (SQLite since NSS 3.12), but you don't have to worry about these, there's and NSS with NSPR package which is compact thus it contains all sources required to build NSS.

To avoid confusion, building NSS on Windows doesn't make use of Cygwin. If you have it (or an other version of MinGW) installed on your computer, it's a good idea to rename its folder until you're finished building NSS to avoid conflicts.

Prerequisites

1. Get NSS

Download ​NSS with NSPR 3.12.5. Extract it so somewhere (you'll get an nss-3.12.5-with-nspr-4.8.2 directory).

2. Get MozillaBuild?

Download ​MozillaBuild 1.4 and install it. By default it installs to c:\mozilla-build. Add c:\mozilla-build\msys\bin and c:\mozilla-build\moztools\bin to your PATH.

3. Get MinGW

Download a recent build of the ​MinGW-w64 w32 toolchain. Extract it to c:\mozilla-build\msys so that MSYS and MinGW have the same folder hiearchy (e.g. MinGW binaries go to c:\mozilla-build\msys\bin etc.).

Choose build flavour

The 3 most important options are:

• target OS
• optimization
• debug RTL

You can toggle them with environmental variables. Here's the matrix:

.	BUILD_OPT=0		BUILD_OPT=1
.	USE_DEBUG_RTL=0	USE_DEBUG_RTL=1	USE_DEBUG_RTL=0	USE_DEBUG_RTL=1
OS_TARGET=WIN95	WIN954.0_DBG.OBJ	WIN954.0_DBG.OBJD	WIN954.0_OPT.OBJ	N/A
OS_TARGET=WINNT	WINNT6.1_DBG.OBJ	WINNT6.1_DBG.OBJD	WINNT6.1_OPT.OBJ	N/A

The version after WINNT is the version of your current OS (you can check it with the winver command). WINNT6.1 assumes you're building on Windows 7.

The default values are 0 for numerical variables and current OS for OS_TARGET. So on Windows 7 with no values set you'll end up building WINNT6.1_DBG.OBJ.

Pick the desired configuration (in other words, cell), and set the environmental variables with set. Example:

set BUILD_OPT=1
set OS_TARGET=WIN95

WARNING: it seems the builder considers any variable as 1 if it's set. So if you enter

set BUILD_OPT=0

you'll get an optimized build although you wanted a debug one. The answer lies in mozilla\security\coreconf\WIN32.mk. They check variables with ifdefs, which is just plain wrong (or they should mention it this way in the documentation).

Solution: set a variable only if you want the related build. Here's the table for seeing what you actually have to enter and what you'll get:

USE_DEBUG_RTL=1			BUILD_OPT=1
OS_TARGET=WIN95	WIN954.0_DBG.OBJ	WIN954.0_DBG.OBJD	WIN954.0_OPT.OBJ
OS_TARGET=WINNT	WINNT6.1_DBG.OBJ	WINNT6.1_DBG.OBJD	WINNT6.1_OPT.OBJ

OS_TARGET is an exception and isn't affected by this error because it's not numerical, so the script checks for its value instead of its existence. As a sidenote, BUILD_OPT seems to have a higher priority, so if you enter

set BUILD_OPT=1
set USE_DEBUG_RTL=1

you'll get an optimized build without linking with the debug RTL. In case you want, for example, a debug build after an optimized, you can unset the variable by setting it without a value, such as:

set BUILD_OPT=

More info about the build variables can be found on the ​Build instructions page of the Mozilla Developer Central.

Patch NSS

There's an error which prevents NSS from building with GCC. Apply the following patch to nss-3.12.5-with-nspr-4.8.2\mozilla\security\nss\lib\freebl\config.mk:

--- config.mk.orig	2009-04-12 00:18:42 +0200
+++ config.mk	2010-02-28 20:19:08 +0100
@@ -85,8 +85,10 @@
 RESNAME = freebl.rc
 
 ifndef WINCE
+ifndef NS_USE_GCC
 OS_LIBS += shell32.lib
 endif
+endif
 
 ifdef NS_USE_GCC
 EXTRA_SHARED_LIBS += \

Build NSS

Start command prompt and go to nss-3.12.5-with-nspr-4.8.2\mozilla\security\nss.

make nss_build_all

The resulting binaries will be placed in nss-3.12.5-with-nspr-4.8.2\mozilla\dist. The contents of private and public are the same accross all flavours so they can be distributed separately.