Uprev NSS requirement on Linux to 3.26

crypto/nss_util.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/nss_util.h"
 
 #include <nss.h>
 #include <pk11pub.h>
 #include <plarena.h>
 #include <prerror.h>
@@ skipping 652 matching lines @@
       : tpm_token_enabled_for_nss_(false),
         initializing_tpm_token_(false),
         chaps_module_(nullptr),
         root_(nullptr) {
     // It's safe to construct on any thread, since LazyInstance will prevent any
     // other threads from accessing until the constructor is done.
     thread_checker_.DetachFromThread();
 
     EnsureNSPRInit();
 
-    // We *must* have NSS >= 3.14.3.
+    // We *must* have NSS >= 3.26.
     static_assert(
-        (NSS_VMAJOR == 3 && NSS_VMINOR == 14 && NSS_VPATCH >= 3) ||
-        (NSS_VMAJOR == 3 && NSS_VMINOR > 14) ||
+        (NSS_VMAJOR == 3 && NSS_VMINOR >= 26) ||

[Tom Anderson, 2017/03/01 19:36:58]

This won't work when compiling against the Wheezy sysroot.  You'll need to
either
1. Change this to a runtime check
2. Wait until we switch to the Jessie sysroot

Option 2 should become possible within a week, but it's up to you

         (NSS_VMAJOR > 3),
         "nss version check failed");
     // Also check the run-time NSS version.
     // NSS_VersionCheck is a >= check, not strict equality.
-    if (!NSS_VersionCheck("3.14.3")) {
-      LOG(FATAL) << "NSS_VersionCheck(\"3.14.3\") failed. NSS >= 3.14.3 is "
+    if (!NSS_VersionCheck("3.26")) {
+      LOG(FATAL) << "NSS_VersionCheck(\"3.26\") failed. NSS >= 3.26 is "
                     "required. Please upgrade to the latest NSS, and if you "
                     "still get this error, contact your distribution "
                     "maintainer.";
     }
 
     SECStatus status = SECFailure;
     base::FilePath database_dir = GetInitialConfigDirectory();
     if (!database_dir.empty()) {
       // This duplicates the work which should have been done in
       // EarlySetupForNSSInit. However, this function is idempotent so
@@ skipping 282 matching lines @@
   return time.ToInternalValue() - base::Time::UnixEpoch().ToInternalValue();
 }
 
 #if !defined(OS_CHROMEOS)
 PK11SlotInfo* GetPersistentNSSKeySlot() {
   return g_nss_singleton.Get().GetPersistentNSSKeySlot();
 }
 #endif
 
 }  // namespace crypto