Building NSS on Windows

Preamble

​Network Security Services (NSS) is the library Pidgin uses for connecting to SSL-enabled servers. NSS depends on NSPR and a ​shared database (SQLite since ​NSS 3.12), but you don't have to worry about these as the downloads from Mozilla contain all sources required to build the libraries.

Note: at the moment you can't build NSS completely using GCC/MinGW. It fails at the final stage when linking additional tools. However, you can build all the important libraries successfully. The instructions below are for building NSS using the Windows Driver Kit (WDK), which does build completely.

Prerequisites

1. GNU Patch:
   Download ​Patch from the !GnuWin32 project. Note that Windows thinks that "patch.exe" is a patch for a program and will prompt you to UAC elevate it whenever you use it (see ​this page).
2. Windows SDK:
   Download the ​Windows SDK for Windows 7 SP1 and install it to the default location. If you have Visual Studio 2010 Pro or Ultimate installed, this step can be ignored.
   NOTE: The build script below is written for Visual Studio 2010 and its included SDK - it might be necessary to tweak the script for any other configuration.
3. Windows Driver Kit (WDK):
   Download the ​WDK for Windows 7 SP1 and install it to the default location.
4. Network Security Services (NSS) source :
   Download the latest version of ​NSS with NSPR (currently 3.16) and extract it to c:\devel\pidgin-devel\win32-dev\nss.
5. MozillaBuild:
   Download the latest version of ​MozillaBuild and install it to c:\devel\mozilla-build.
6. WDK build patch:
   Download the ​HexChat project's WDK build patch to c:\devel\pidgin-devel\win32-dev\nss\nss-wdk.patch.
7. WDK build script:
   Download this build script to c:\devel\pidgin-devel\win32-dev\nss\build-x86.bat.

Prepare the build tree

Open a command prompt at your NSS/NSPR directory and run "%PROGRAMFILES(X86)%\GnuWin32\bin\patch" -p1 --dry-run --binary -i nss-wdk.patch. If there aren't any problems, re-run the command without the --dry-run flag.

Once this is done, open c:\devel\pidgin-devel\win32-dev\nss\build-x86.bat in your editor of choice and adjust it so that the WDK binaries, mt.exe from the Windows SDK, and lib.exe from the Visual C++ compiler package are all in the PATH. If you have Visual Studio 2010 installed, it should work without modification as long as the paths are correct.

Choose build configuration

The NSS build configuration is controlled by environment variables. The most important options are:

• Enable optimizations (BUILD_OPT)
• Use debug runtime library (USE_DEBUG_RTL)
• Enable elliptic curve cryptography (NSS_ENABLE_ECC)
  • This is enabled by default as of NSS 3.16
• Disable legacy DBM database (NSS_DISABLE_DBM)
• Build for Windows NT (OS_TARGET=WINNT)
• Disable LDAP URI Support (NSS_PKIX_NO_LDAP)

The first two options select the build type according to the matrix below:

	USE_DEBUG_RTL=0	USE_DEBUG_RTL=1
BUILD_OPT=0	WINNT5.1_DBG.OBJ	WINNT5.1_DBG.OBJD
BUILD_OPT=1	WINNT5.1_OPT.OBJ	N/A

The version after WINNT is the target OS version - WINNT5.1 assumes you're building for Windows XP.

The second two options control which features are enabled. Normally, both NSS_ENABLE_ECC and NSS_DISABLE_DBM should be selected.

When using the build script below, the default build is WINNT5.1_OPT.OBJ with ECC enabled and DBM disabled. In order to override these settings, set the corresponding environment variables to 0 or 1 before performing the build. Note that this behavior is different than when using the Mozilla makefiles directly. More info about the build variables can be found on the ​build instructions page of Mozilla Developer Central.

Do the build

Launch a Windows XP build environment window (Start > All Programs > Windows Driver Kits > WDK 7600.16385.1 > Build Environments > Windows XP > x86 Free Build Environment) and navigate to c:\devel\pidgin-devel\win32-dev\nss. When you're ready to build, run build-x86 and wait for the build to complete!

The resulting binaries will be placed in c:\devel\pidgin-devel\win32-dev\nss\nss-<version>\dist. The contents of private and public are the same across all configurations so they can be distributed separately. The following files need to be distributed with Pidgin:

• libnspr4.dll
• libplds4.dll
• libplc4.dll
• nssutil3.dll
• freebl3.dll
• sqlite3.dll
• softokn3.dll
• nss3.dll
• ssl3.dll
• softokn3.chk
• freebl3.chk

Generate the zip file for BuildingWinPidgin:

NSS_VERSION=<nss-version>
NSPR_VERSION=<nspr-version>
PIDGIN_WIN32_DEV_TOP=.../pidgin-devel/win32-dev
cp -R nss-$NSS_VERSION/dist/WINNT5.1_OPT.OBJ/ $PIDGIN_WIN32_DEV_TOP/nss-$NSS_VERSION-nspr-$NSPR_VERSION/
cp -R nss-$NSS_VERSION/dist/public/nss/* $PIDGIN_WIN32_DEV_TOP/nss-$NSS_VERSION-nspr-$NSPR_VERSION/include/
cd $PIDGIN_WIN32_DEV_TOP
tar czf nss-$NSS_VERSION-nspr-$NSPR_VERSION.tar.gz nss-$NSS_VERSION-nspr-$NSPR_VERSION
gpg -ab nss-$NSS_VERSION-nspr-$NSPR_VERSION.tar.gz
gpg --verify nss-$NSS_VERSION-nspr-$NSPR_VERSION.tar.gz.asc