build: Use system NSS when possible

[larseggert]

When NSS_DIR is not set, we now attempt to use the system NSS, and check whether it is recent enough for us. The current NSS minimum version is in neqo-crypto/min_version.txt, so it can be accessed by Rust (via neqo-crypto/src/min_version.rs) and by the CI scripts.

Fixes #1711

[martinthomson]

I think that you can cut most of fn nss_dir() now that you won't be hitting it as often. Just pass the env variable in to setup_standalone()

[larseggert]

I think that you can cut most of fn nss_dir() now that you won't be hitting it as often. Just pass the env variable in to setup_standalone()

nss_dir() has the code that checks out NSS and NSPR if there is no copy already. Are you saying that should be cut, i.e., will we require people to do their own checkouts?

Ping @martinthomson

[martinthomson]

OK, so approvals with comments get merged. That's not ideal.

[martinthomson]

@larseggert should we require that conversations are resolved before merging?

[larseggert]

@martinthomson we can turn that on, but then we should probably turn off Require approval of the most recent reviewable push, because otherwise a re-review would be required just as it is now if one had chosen "request changes"?

[larseggert]

I think that you can cut most of fn nss_dir() now that you won't be hitting it as often. Just pass the env variable in to setup_standalone()

@martinthomson: nss_dir() has the code that checks out NSS and NSPR if there is no copy already. Are you saying that should be cut, i.e., will we require people to do their own checkouts?

[martinthomson]

turn off Require approval of the most recent reviewable push

Yeah, I think that we can trust people to exercise their judgment on the small stuff.

will we require people to do their own checkouts?

Yeah. You will observe that you can't reach that code unless you set NSS_DIR but haven't got a copy of NSS. Given that the main reason to use NSS_DIR is to point to a copy you are working on, that seems like a good trade to me.