From 9e0aaf30aab7c61e5cacd4cdc44243a7557e2d2b Mon Sep 17 00:00:00 2001
From: aszlig <aszlig@redmoonstudios.org>
Date: Tue, 21 Aug 2012 21:35:46 +0200
Subject: [PATCH] nss: Sign libraries after striping.

Running NSS in FIPS mode is only possible if the libraries are signed correctly,
so we're doing this in the postFixup hook, to insure nothing gets altered after
that phase.

For more information about FIPS mode, please see:
https://developer.mozilla.org/en-US/docs/NSS/FIPS_Mode_-_an_explanation
---
 pkgs/development/libraries/nss/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index 222fd6e94f6f..3b6cc15754e2 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -86,4 +86,12 @@ stdenv.mkDerivation rec {
         --subst-var-by includedir $out/include/nss \
         --subst-var-by libdir $out/lib
     ''; # */
+
+  postFixup = ''
+    for libname in freebl3 nssdbm3 softokn3
+    do
+      libfile="$out/lib/lib$libname.so"
+      LD_LIBRARY_PATH=$out/lib $out/bin/shlibsign -v -i "$libfile"
+    done
+  '';
 }