revert the gyp-based nss build changes

https://lists.freedesktop.org/archives/libreoffice/2020-March/084769.html
etc.

This reverts commit c76fdcf1cfa1242e66b50ebe80d6eac1baae37a9.
This reverts commit 10f52ab4d27263439d59f55f40e88ad2fde0cf71.
This reverts commit eac806e8dcd9ee6439ac8695978ff6b62cc6b8d2.
This reverts commit d591a682e46ff352f06a61c024ef661dd17f4ea4.
This reverts commit 12235d3390a7fc5146bf65f9d6166034b8a048ee.
This reverts commit 23245f723fb29262b8543d6447d1b0bb69cb50fb.
This reverts commit 91658b402b66b67c785687d5b3a76e3183fe76bf.
This reverts commit 5feadfad0cc3be2680213d2e5f6f786b2f4cc74f.
This reverts commit fecca49c309fc723c524f12fa671114b316a5562.
This reverts commit c6a9454e744289cf2004b42b3c90854b2db8382b.
This reverts commit a1a62a70411cb6041b5930ead08280d5e1e7b5f9.
This reverts commit 8512f4ca090c85477a6670438aeefe7fdfcf8a98.
This reverts commit 532ffb7a297d55b495141ce33692df5d9917b54f.

Change-Id: Iaa48d692bea2ca2468cdd5f8ad26ad91c0c31dde
Reviewed-on: https://gerrit.libreoffice.org/c/core/+/91199
Tested-by: Jenkins
Reviewed-by: Luboš Luňák <l.lunak@collabora.com>

15 files changed, 30 insertions, 527 deletions

diff --git a/external/nss/ExternalProject_nss.mk b/external/nss/ExternalProject_nss.mk
index 28e2476c5c8c..acf418805772 100644
--- a/external/nss/ExternalProject_nss.mk
+++ b/external/nss/ExternalProject_nss.mk
@@ -16,69 +16,25 @@ $(eval $(call gb_ExternalProject_register_targets,nss,\
 ))
 
 ifeq ($(OS),WNT)
-
-$(eval $(call gb_ExternalProject_use_autoconf,nss,build))
-
-# The nss build system uses 'python', even recursively, so make it find our internal python if necessary.
-nss_PYTHON := $(call gb_UnpackedTarball_get_dir,nss)/python
-nss_SETUP_PYTHON := $(call gb_UnpackedTarball_get_dir,nss)/setup-python
-
-$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python) $(call gb_UnpackedTarball_get_target,gyp)
-	$(call gb_Trace_StartRange,nss,EXTERNAL)
-	cp $(SRCDIR)/external/nss/python-cygwin-template $(nss_PYTHON)
-	pythondir=$$($(call gb_ExternalExecutable_get_command,python) -c 'import sys; import os; sys.stdout.write(os.path.dirname(sys.executable))') \
-		&& echo PATH=\"$$pythondir:\$$PATH\" >>$(nss_PYTHON)
-	echo '$(call gb_ExternalExecutable_get_command,python)' \"$$\{args[@]\}\" >>$(nss_PYTHON)
-	chmod +x $(nss_PYTHON)
-	cp $(SRCDIR)/external/nss/setup-python $(nss_SETUP_PYTHON)
-	chmod +x $(nss_SETUP_PYTHON)
-	$(call gb_ExternalProject_run,build,\
-			COMMA=$(COMMA) \
-			PATH=$$(cygpath $(call gb_UnpackedTarball_get_dir,nss)):$$(cygpath $(call gb_UnpackedTarball_get_dir,gyp)):$$PATH \
-			MAKE=$(MAKE) \
-			NINJA='$(subst ','\'',$(NINJA))' \
-			NSINSTALL='$(SRCDIR)/external/nss/nsinstall.py' \
-			LIB="$(ILIB)" \
-			RC="rc.exe $(SOLARINC)" \
-			CL="-arch:SSE" \
-			./build.sh -v --disable-tests --enable-libpkix \
-				$(if $(filter X86_64,$(CPUNAME)),--target=x64,--target=ia32) \
-				$(if $(ENABLE_DBGUTIL),,--opt) \
-				$(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED),--symbols) \
-		&& rm -f $(call gb_UnpackedTarball_get_dir,nss)/dist/out/lib/*.a \
-	,nss)
-	for f in $(call gb_UnpackedTarball_get_dir,nss)/dist/out/lib/*.dll.lib; do mv "$$f" "$${f%.dll.lib}".lib; done
-	$(call gb_Trace_EndRange,nss,EXTERNAL)
-
-# non-WNT gyp-based
-# update nss_needs_ninja in configure.ac if the list changes
-else ifneq (,$(filter FREEBSD LINUX NETBSD OPENBSD SOLARIS,$(OS)))
-
-# The nss build system uses 'python', so make it find our internal python if necessary.
-nss_PYTHON := $(call gb_UnpackedTarball_get_dir,nss)/python
-nss_SETUP_PYTHON := $(call gb_UnpackedTarball_get_dir,nss)/setup-python
-
-$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python) $(call gb_UnpackedTarball_get_target,gyp)
+$(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python)
 	$(call gb_Trace_StartRange,nss,EXTERNAL)
-	echo "#! /bin/sh" > $(nss_PYTHON)
-	pythondir=$$($(call gb_ExternalExecutable_get_command,python) -c 'import sys; import os; sys.stdout.write(os.path.dirname(sys.executable))') \
-		&& echo PATH=\"$$pythondir:\$$PATH\" >>$(nss_PYTHON)
-	echo '$(call gb_ExternalExecutable_get_command,python)' \"$$\@\" $(if $(ICECREAM_RUN), | sed 's/$(ICECREAM_RUN)//') >> $(nss_PYTHON)
-	chmod +x $(nss_PYTHON)
-	cp $(SRCDIR)/external/nss/setup-python $(nss_SETUP_PYTHON)
-	chmod +x $(nss_SETUP_PYTHON)
 	$(call gb_ExternalProject_run,build,\
-			COMMA=$(COMMA) \
-			PATH=$(call gb_UnpackedTarball_get_dir,nss):$(call gb_UnpackedTarball_get_dir,gyp):$$PATH \
-			NINJA='$(subst ','\'',$(NINJA))' \
-			./build.sh -v --disable-tests --enable-libpkix \
-				$(if $(ENABLE_DBGUTIL),,--opt) \
-				$(if $(COM_IS_CLANG),$(if $(filter -fsanitize=%,$(CC)),--no-zdefs)) \
-		&& rm -f $(call gb_UnpackedTarball_get_dir,nss)/dist/out/lib/*.a \
+		$(if $(MSVC_USE_DEBUG_RUNTIME),USE_DEBUG_RTL=1,BUILD_OPT=1) \
+		$(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
+			MOZ_DEBUG_SYMBOLS=1 \
+			MOZ_DEBUG_FLAGS=" " \
+			OPT_CODE_SIZE=0) \
+		MOZ_MSVCVERSION=9 OS_TARGET=WIN95 \
+		$(if $(filter X86_64,$(CPUNAME)),USE_64=1) \
+		LIB="$(ILIB)" \
+		XCFLAGS="-arch:SSE $(SOLARINC)" \
+		$(MAKE) -j1 nss_build_all RC="rc.exe $(SOLARINC)" \
+			NSINSTALL='$(call gb_ExternalExecutable_get_command,python) $(SRCDIR)/external/nss/nsinstall.py' \
+			NSS_DISABLE_GTESTS=1 \
 	,nss)
 	$(call gb_Trace_EndRange,nss,EXTERNAL)
 
-else # platforms which need(?) the old build system (feel free to port to the new system)
+else # OS!=WNT
 # make sure to specify NSPR_CONFIGURE_OPTS as env (before make command), so nss can append it's own defaults
 # OTOH specify e.g. CC and NSINSTALL as arguments (after make command), so they will overrule nss makefile values
 $(call gb_ExternalProject_get_state_target,nss,build): $(call gb_ExternalExecutable_get_dependencies,python)
diff --git a/external/nss/Module_nss.mk b/external/nss/Module_nss.mk
index be4b01e7ae4e..eae9e9524480 100644
--- a/external/nss/Module_nss.mk
+++ b/external/nss/Module_nss.mk
@@ -11,7 +11,6 @@ $(eval $(call gb_Module_Module,nss))
 
 $(eval $(call gb_Module_add_targets,nss,\
 	UnpackedTarball_nss \
-	UnpackedTarball_gyp \
 	ExternalPackage_nss \
 	ExternalProject_nss \
 ))
diff --git a/external/nss/UnpackedTarball_gyp.mk b/external/nss/UnpackedTarball_gyp.mk
deleted file mode 100644
index 72358686e97a..000000000000
--- a/external/nss/UnpackedTarball_gyp.mk
+++ /dev/null
@@ -1,27 +0,0 @@
-# -*- Mode: makefile-gmake; tab-width: 4; indent-tabs-mode: t -*-
-#
-# This file is part of the LibreOffice project.
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-
-$(eval $(call gb_UnpackedTarball_UnpackedTarball,gyp))
-
-$(eval $(call gb_UnpackedTarball_set_tarball,gyp,$(GYP_TARBALL)))
-
-$(eval $(call gb_UnpackedTarball_set_patchlevel,gyp,0))
-
-$(eval $(call gb_UnpackedTarball_add_patches,gyp,\
-	external/nss/gyp-buildsystem.patch.0 \
-	external/nss/gyp-rpath.patch \
-))
-
-ifeq ($(OS),WNT)
-$(eval $(call gb_UnpackedTarball_add_patches,gyp,\
-	external/nss/gyp-buildsystem-windows.patch.0 \
-))
-endif
-
-# vim: set noet sw=4 ts=4:
diff --git a/external/nss/UnpackedTarball_nss.mk b/external/nss/UnpackedTarball_nss.mk
index ac1d3c9928e2..0e174879a702 100644
--- a/external/nss/UnpackedTarball_nss.mk
+++ b/external/nss/UnpackedTarball_nss.mk
@@ -34,15 +34,14 @@ $(eval $(call gb_UnpackedTarball_add_patches,nss,\
 		external/nss/nss-android.patch.1) \
 	external/nss/nss.bzmozilla1238154.patch \
     external/nss/macos-dlopen.patch.0 \
-	external/nss/buildsystem.patch.0 \
-	external/nss/fix-cc-detect-with-ccache.patch.0 \
-	external/nss/nss-online.patch.0 \
 ))
 
-ifeq ($(OS),WNT)
+ifeq ($(COM_IS_CLANG),TRUE)
+ifneq ($(filter -fsanitize=%,$(CC)),)
 $(eval $(call gb_UnpackedTarball_add_patches,nss,\
-	external/nss/buildsystem-windows.patch.0 \
+	external/nss/asan.patch.1 \
 ))
 endif
+endif
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/nss/asan.patch.1 b/external/nss/asan.patch.1
new file mode 100644
index 000000000000..7dfd6ed4e782
--- /dev/null
+++ b/external/nss/asan.patch.1
@@ -0,0 +1,12 @@
+diff -ur nss.org/nss/coreconf/Linux.mk nss/nss/coreconf/Linux.mk
+--- nss.org/nss/coreconf/Linux.mk	2014-05-06 04:36:01.817838877 +0200
++++ nss/nss/coreconf/Linux.mk	2014-05-06 04:37:25.387835456 +0200
+@@ -146,7 +146,7 @@
+ # we don't use -z defs there.
+ # Also, -z defs conflicts with Address Sanitizer, which emits relocations
+ # against the libsanitizer runtime built into the main executable.
+-ZDEFS_FLAG		= -Wl,-z,defs
++ZDEFS_FLAG		=
+ DSO_LDOPTS		+= $(if $(findstring 2.11.90.0.8,$(shell ld -v)),,$(ZDEFS_FLAG)) $(if $(filter-out $(OS),ANDROID),-Wl$(COMMA)-z$(COMMA)origin '-Wl$(COMMA)-rpath$(COMMA)$$ORIGIN')
+ LDFLAGS			+= $(ARCHFLAG) -z noexecstack
+ 
diff --git a/external/nss/buildsystem-windows.patch.0 b/external/nss/buildsystem-windows.patch.0
deleted file mode 100644
index f6e26d886df3..000000000000
--- a/external/nss/buildsystem-windows.patch.0
+++ /dev/null
@@ -1,135 +0,0 @@
---- ./nss/coreconf/nspr.sh.sav	2019-11-19 20:55:30.000000000 +0100
-+++ ./nss/coreconf/nspr.sh	2020-02-19 22:25:05.863542364 +0100
-@@ -35,10 +35,13 @@
-         else
-             extra_params+=(--disable-debug --enable-optimize)
-         fi
-+    else
-+        extra_params+=(--enable-debug-rtl)
-     fi
-     if [ "$target_arch" = "x64" ]; then
-         extra_params+=(--enable-64bit)
-     fi
-+    extra_params+=(--enable-win32-target=WIN95)
- 
-     echo "NSPR [1/5] configure ..."
-     pushd "$nspr_dir" >/dev/null
-@@ -43,24 +46,24 @@
-           run_verbose ../configure "${extra_params[@]}" "$@"
-     popd >/dev/null
-     echo "NSPR [2/5] make ..."
--    run_verbose make -C "$nspr_dir"
-+    run_verbose $MAKE -C $(cygpath -w "$nspr_dir") NSINSTALL=$NSINSTALL RC="$RC"
- 
-     if [ "$build_nspr_tests" = 1 ]; then
-       echo "NSPR [3/5] build tests ..."
--      run_verbose make -C "$nspr_dir/pr/tests"
-+      run_verbose $MAKE -C $(cygpath -w "$nspr_dir/pr/tests")
-     else
-         echo "NSPR [3/5] NOT building tests"
-     fi
- 
-     if [[ "$build_nspr_tests" = 1 && "$run_nspr_tests" = 1 ]]; then
-       echo "NSPR [4/5] run tests ..."
--      run_verbose make -C "$nspr_dir/pr/tests" runtests
-+      run_verbose $MAKE -C $(cygpath -w "$nspr_dir/pr/tests") runtests
-     else
-         echo "NSPR [4/5] NOT running tests"
-     fi
- 
-     echo "NSPR [5/5] install ..."
--    run_verbose make -C "$nspr_dir" install
-+    run_verbose $MAKE -C $(cygpath -w "$nspr_dir") install NSINSTALL=$NSINSTALL
- }
- 
- nspr_clean()
---- ./nss/build.sh.sav	2019-11-19 20:55:30.000000000 +0100
-+++ ./nss/build.sh	2020-02-19 22:28:30.976068194 +0100
-@@ -155,9 +155,10 @@
-     gyp_params+=(-Dsanitizer_flags="$sanitizer_flags")
- fi
- 
--if [ "$msvc" = 1 ]; then
--    source "$cwd/coreconf/msvc.sh"
--fi
-+# this breaks nspr
-+#if [ "$msvc" = 1 ]; then
-+#    source "$cwd/coreconf/msvc.sh"
-+#fi
- 
- # -c = clean first
- if [ "$clean" = 1 -o "$clean_only" = 1 ]; then
-@@ -236,6 +237,9 @@
-   exit 0
- fi
- 
-+# set up for gyp
-+source "$cwd/coreconf/msvc.sh"
-+
- # gyp.
- if [ "$rebuild_gyp" = 1 ]; then
-     if ! hash "$GYP" 2> /dev/null; then
-@@ -263,4 +267,4 @@
-     echo "Building NSS requires an installation of ninja: https://ninja-build.org/" 1>&2
-     exit 3
- fi
--run_scanbuild setup-python "$ninja" -C "$target_dir" "${ninja_params[@]}"
-+run_scanbuild setup-python $(cygpath -w $(which "$ninja")) -C $(cygpath -w "$target_dir") "${ninja_params[@]}"
---- ./nss/coreconf/msvc.sh.sav	2019-11-19 20:55:30.000000000 +0100
-+++ ./nss/coreconf/msvc.sh	2020-02-21 17:42:32.344129200 +0100
-@@ -2,6 +2,9 @@
- # This configures the environment for running MSVC.  It uses vswhere, the
- # registry, and a little knowledge of how MSVC is laid out.
- 
-+PATH="$PATH:/cygdrive/c/Program Files (x86)/Microsoft Visual Studio/Installer/"
-+set -o igncr
-+
- if ! hash vswhere 2>/dev/null; then
-     echo "Can't find vswhere on the path, aborting" 1>&2
-     exit 1
-@@ -17,11 +17,7 @@
- 
- # Turn a unix-y path into a windows one.
- fixpath() {
--    if hash cygpath 2>/dev/null; then
--        cygpath --unix "$1"
--    else # haxx
--        echo "$1" | sed -e 's,\\,/,g;s,^\(.\):,/\L\1,;s,/$,,'
--    fi
-+    echo "$1"
- }
- 
- # Query the registry.  This takes $1 and tags that on the end of several
-@@ -94,6 +89,8 @@
-     INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/um"
-     INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/winrt"
-     INCLUDE="${INCLUDE}:${UniversalCRTSdkDir}/include/${UCRTVersion}/cppwinrt"
-+    # : -> ; as the separator
-+    INCLUDE=$(echo "$INCLUDE" | sed 's/:C/;C/g')
-     export INCLUDE
- 
-     LIB="${VCINSTALLDIR}/lib/${m}"
---- ./nspr/configure.sav	2020-02-21 21:40:01.218554800 +0100
-+++ ./nspr/configure	2020-02-21 21:41:32.434189100 +0100
-@@ -5977,10 +5977,6 @@
-     NSINSTALL=nsinstall
-     ;;
- *-cygwin*|*-mks*)
--    NSINSTALL='$(CYGWIN_WRAPPER) nsinstall'
--    if test `echo "${PATH}" | grep -c \;` = 0; then
--        CYGWIN_WRAPPER='sh $(topsrcdir)/build/cygwin-wrapper'
--    fi
-     ;;
- *os2*)
-     ;;
---- nss/coreconf/config.gypi.sav	2019-11-19 20:55:30.000000000 +0100
-+++ nss/coreconf/config.gypi	2020-03-04 16:28:46.512443300 +0100
-@@ -44,7 +44,7 @@
-         }],
-         ['OS=="win"', {
-           'use_system_zlib%': 0,
--          'nspr_libs%': ['libnspr4.lib', 'libplc4.lib', 'libplds4.lib'],
-+          'nspr_libs%': ['nspr4.lib', 'plc4.lib', 'plds4.lib'],
-           'zlib_libs%': [],
-           #TODO
-           'moz_debug_flags%': '',
diff --git a/external/nss/buildsystem.patch.0 b/external/nss/buildsystem.patch.0
deleted file mode 100644
index 23583d1e87ba..000000000000
--- a/external/nss/buildsystem.patch.0
+++ /dev/null
@@ -1,110 +0,0 @@
---- ./nss/coreconf/nspr.sh.sav	2019-11-19 20:55:30.000000000 +0100
-+++ ./nss/coreconf/nspr.sh	2020-02-19 22:25:05.863542364 +0100
-@@ -28,9 +28,13 @@
- 
-     # These NSPR options are directory-specific, so they don't need to be
-     # included in nspr_opt and changing them doesn't force a rebuild of NSPR.
--    extra_params=(--prefix="$dist_dir"/$target)
-+    extra_params=(--prefix="$dist_dir"/out --libdir="$dist_dir"/out/lib --includedir="$dist_dir"/out/include)
-     if [ "$opt_build" = 1 ]; then
--        extra_params+=(--disable-debug --enable-optimize)
-+        if [ "$symbols_build" = 1 ]; then
-+            extra_params+=(--enable-debug-symbols --enable-optimize)
-+        else
-+            extra_params+=(--disable-debug --enable-optimize)
-+        fi
-     fi
-     if [ "$target_arch" = "x64" ]; then
-         extra_params+=(--enable-64bit)
---- ./nss/build.sh.sav	2019-11-19 20:55:30.000000000 +0100
-+++ ./nss/build.sh	2020-02-19 22:28:30.976068194 +0100
-@@ -50,6 +50,7 @@
- fi
- 
- opt_build=0
-+symbols_build=0
- build_64=0
- clean=0
- rebuild_gyp=0
-@@ -96,6 +97,7 @@
-         -j) ninja_params+=(-j "$2"); shift ;;
-         --gyp|-g) rebuild_gyp=1 ;;
-         --opt|-o) opt_build=1 ;;
-+        --symbols) symbols_build=1 ;;
-         -m32|--m32) target_arch=ia32; echo 'Warning: use -t instead of -m32' 1>&2 ;;
-         -t|--target) target_arch="$2"; shift ;;
-         --target=*) target_arch="${1#*=}" ;;
-@@ -139,7 +141,11 @@
- # Set the target architecture and build type.
- gyp_params+=(-Dtarget_arch="$target_arch")
- if [ "$opt_build" = 1 ]; then
--    target=Release
-+    if [ "$symbols_build" = 1 ]; then
-+        target=ReleaseSymbols
-+    else
-+        target=Release
-+    fi
- else
-     target=Debug
- fi
-@@ -243,10 +243,10 @@
-         exit 3
-     fi
-     # These extra arguments aren't used in determining whether to rebuild.
--    obj_dir="$dist_dir/$target"
-+    obj_dir="$dist_dir/out"
-     gyp_params+=(-Dnss_dist_obj_dir="$obj_dir")
-     if [ "$no_local_nspr" = 0 ]; then
--        set_nspr_path "$obj_dir/include/nspr:$obj_dir/lib"
-+        set_nspr_path "$obj_dir/include:$obj_dir/lib"
-     fi
- 
-     run_verbose run_scanbuild ${GYP} -f ninja "${gyp_params[@]}" "$cwd/nss.gyp"
-@@ -261,7 +261,9 @@ if [ "$rebuild_gyp" = 1 ]; then
- fi
- 
- # ninja.
--if hash ninja-build 2>/dev/null; then
-+if test -n "$NINJA"; then
-+    ninja="$NINJA"
-+elif hash ninja-build 2>/dev/null; then
-     ninja=ninja-build
- elif hash ninja 2>/dev/null; then
-     ninja=ninja
-@@ -263,4 +263,4 @@
-     echo "Building NSS requires an installation of ninja: https://ninja-build.org/" 1>&2
-     exit 3
- fi
--run_scanbuild "$ninja" -C "$target_dir" "${ninja_params[@]}"
-+run_scanbuild setup-python "$ninja" -C "$target_dir" "${ninja_params[@]}"
---- ./nss/coreconf/config.gypi.sav	2020-03-06 16:10:17.371503700 +0100
-+++ ./nss/coreconf/config.gypi	2020-03-06 16:34:14.868824800 +0100
-@@ -612,6 +612,18 @@
-           },
-         },
-       },
-+      'ReleaseSymbols': {
-+        'inherit_from': ['Release'],
-+        'cflags': [ '-g' ],
-+        'msvs_settings': {
-+          'VCCLCompilerTool': {
-+            'DebugInformationFormat': '3', # /Zi
-+          },
-+          'VCLinkerTool': {
-+            'GenerateDebugInformation': '1',
-+          },
-+        },
-+      },
-       'conditions': [
-         [ 'OS=="win"', {
-           # The gyp ninja backend requires these.
-@@ -624,6 +636,9 @@
-           'Release_x64': {
-             'inherit_from': ['Release'],
-           },
-+          'ReleaseSymbols_x64': {
-+            'inherit_from': ['ReleaseSymbols'],
-+          },
-         }],
-       ],
-     },
diff --git a/external/nss/fix-cc-detect-with-ccache.patch.0 b/external/nss/fix-cc-detect-with-ccache.patch.0
deleted file mode 100644
index 6c3ebcfb77ed..000000000000
--- a/external/nss/fix-cc-detect-with-ccache.patch.0
+++ /dev/null
@@ -1,11 +0,0 @@
---- ./nss/coreconf/check_cc.py.sav	2020-03-20 17:58:57.275605539 +0100
-+++ ./nss/coreconf/check_cc.py	2020-03-20 18:10:56.053688945 +0100
-@@ -11,7 +11,7 @@ def main():
-         cc = os.environ.get('CC', 'cc')
-         try:
-             cc_is_arg = sys.argv[1] in subprocess.check_output(
--              [cc, '--version'], universal_newlines=True)
-+              cc.split(' ') + ['--version'], universal_newlines=True)
-         except OSError:
-             # We probably just don't have CC/cc.
-             cc_is_arg = False
diff --git a/external/nss/gyp-buildsystem-windows.patch.0 b/external/nss/gyp-buildsystem-windows.patch.0
deleted file mode 100644
index 645690cdf10d..000000000000
--- a/external/nss/gyp-buildsystem-windows.patch.0
+++ /dev/null
@@ -1,10 +0,0 @@
---- pylib/gyp/msvs_emulation.py.sav	2020-02-19 21:45:13.150161000 +0100
-+++ pylib/gyp/msvs_emulation.py	2020-02-21 23:51:56.815937600 +0100
-@@ -996,6 +996,7 @@
-           setting = os.path.dirname(sys.executable) + os.pathsep + setting
-         env[var.upper()] = setting
-         break
-+  env['CL'] = '-arch:SSE'
-   for required in ('SYSTEMROOT', 'TEMP', 'TMP'):
-     if required not in env:
-       raise Exception('Environment variable "%s" '
diff --git a/external/nss/gyp-buildsystem.patch.0 b/external/nss/gyp-buildsystem.patch.0
deleted file mode 100644
index 56502ab874f3..000000000000
--- a/external/nss/gyp-buildsystem.patch.0
+++ /dev/null
@@ -1,119 +0,0 @@
---- pylib/gyp/msvs_emulation.py.sav	2020-02-19 21:45:13.150161000 +0100
-+++ pylib/gyp/msvs_emulation.py	2020-02-21 23:51:56.815937600 +0100
-@@ -138,7 +138,7 @@ def _FindDirectXInstallation():
-   if not dxsdk_dir:
-     # Setup params to pass to and attempt to launch reg.exe.
-     cmd = ['reg.exe', 'query', r'HKLM\Software\Microsoft\DirectX', '/s']
--    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-+    p = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,universal_newlines=True,errors='replace')
-     for line in p.communicate()[0].splitlines():
-       if 'InstallPath' in line:
-         dxsdk_dir = line.split('    ')[3] + "\\"
-@@ -321,7 +321,7 @@ class MsvsSettings(object):
-     # first level is globally for the configuration (this is what we consider
-     # "the" config at the gyp level, which will be something like 'Debug' or
-     # 'Release'), VS2015 and later only use this level
--    if self.vs_version.short_name >= 2015:
-+    if int(self.vs_version.short_name) >= 2015:
-       return config
-     # and a second target-specific configuration, which is an
-     # override for the global one. |config| is remapped here to take into
-@@ -485,7 +485,7 @@ class MsvsSettings(object):
-         prefix='/arch:')
-     cflags.extend(['/FI' + f for f in self._Setting(
-         ('VCCLCompilerTool', 'ForcedIncludeFiles'), config, default=[])])
--    if self.vs_version.project_version >= 12.0:
-+    if float(self.vs_version.project_version) >= 12.0:
-       # New flag introduced in VS2013 (project version 12.0) Forces writes to
-       # the program database (PDB) to be serialized through MSPDBSRV.EXE.
-       # https://msdn.microsoft.com/en-us/library/dn502518.aspx
-@@ -1050,7 +1050,7 @@ def GenerateEnvironmentFiles(toplevel_bu
-     args = vs.SetupScript(arch)
-     args.extend(('&&', 'set'))
-     popen = subprocess.Popen(
--        args, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+        args, shell=True, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     variables, _ = popen.communicate()
-     if popen.returncode != 0:
-       raise Exception('"%s" failed with error %d' % (args, popen.returncode))
-@@ -1071,7 +1071,7 @@ def GenerateEnvironmentFiles(toplevel_bu
-     args = vs.SetupScript(arch)
-     args.extend(('&&',
-       'for', '%i', 'in', '(cl.exe)', 'do', '@echo', 'LOC:%~$PATH:i'))
--    popen = subprocess.Popen(args, shell=True, stdout=subprocess.PIPE)
-+    popen = subprocess.Popen(args, shell=True, stdout=subprocess.PIPE,universal_newlines=True,errors='replace')
-     output, _ = popen.communicate()
-     cl_paths[arch] = _ExtractCLPath(output)
-   return cl_paths
---- pylib/gyp/generator/ninja.py.sav	2020-02-19 21:45:13.150161000 +0100
-+++ pylib/gyp/generator/ninja.py	2020-02-22 00:42:48.090472000 +0100
-@@ -1741,7 +1741,10 @@ def CalculateGeneratorInputInfo(params):
- def OpenOutput(path, mode='w'):
-   """Open |path| for writing, creating directories if necessary."""
-   gyp.common.EnsureDirExists(path)
--  return open(path, mode)
-+  if sys.version_info[0] < 3:
-+    return open(path, mode)
-+  else:
-+    return open(path, mode, encoding="utf-8")
- 
- 
- def CommandWithWrapper(cmd, wrappers, prog):
---- pylib/gyp/win_tool.py.sav	2020-02-19 21:45:13.150161000 +0100
-+++ pylib/gyp/win_tool.py	2020-03-04 12:46:55.098189500 +0100
-@@ -130,7 +130,7 @@ class WinTool(object):
-     # For that reason, since going through the shell doesn't seem necessary on
-     # non-Windows don't do that there.
-     link = subprocess.Popen(args, shell=sys.platform == 'win32', env=env,
--                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+                            stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     out, _ = link.communicate()
-     for line in out.splitlines():
-       if (not line.startswith('   Creating library ') and
-@@ -197,8 +197,8 @@ class WinTool(object):
-       # and sometimes doesn't unfortunately.
-       with open(our_manifest, 'r') as our_f:
-         with open(assert_manifest, 'r') as assert_f:
--          our_data = our_f.read().translate(None, string.whitespace)
--          assert_data = assert_f.read().translate(None, string.whitespace)
-+          our_data = our_f.read().translate(str.maketrans('','', string.whitespace))
-+          assert_data = assert_f.read().translate(str.maketrans('','', string.whitespace))
-       if our_data != assert_data:
-         os.unlink(out)
-         def dump(filename):
-@@ -223,7 +223,7 @@ class WinTool(object):
-     tool)."""
-     env = self._GetEnv(arch)
-     popen = subprocess.Popen(args, shell=True, env=env,
--                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     out, _ = popen.communicate()
-     for line in out.splitlines():
-       if line and 'manifest authoring warning 81010002' not in line:
-@@ -255,7 +255,7 @@ class WinTool(object):
-         idl]
-     env = self._GetEnv(arch)
-     popen = subprocess.Popen(args, shell=True, env=env,
--                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     out, _ = popen.communicate()
-     # Filter junk out of stdout, and write filtered versions. Output we want
-     # to filter is pairs of lines that look like this:
-@@ -274,7 +274,7 @@ class WinTool(object):
-     """Filter logo banner from invocations of asm.exe."""
-     env = self._GetEnv(arch)
-     popen = subprocess.Popen(args, shell=True, env=env,
--                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     out, _ = popen.communicate()
-     for line in out.splitlines():
-       if (not line.startswith('Copyright (C) Microsoft Corporation') and
-@@ -289,7 +289,7 @@ class WinTool(object):
-     don't support the /nologo flag."""
-     env = self._GetEnv(arch)
-     popen = subprocess.Popen(args, shell=True, env=env,
--                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT)
-+                             stdout=subprocess.PIPE, stderr=subprocess.STDOUT,universal_newlines=True,errors='replace')
-     out, _ = popen.communicate()
-     for line in out.splitlines():
-       if (not line.startswith('Microsoft (R) Windows (R) Resource Compiler') and
diff --git a/external/nss/gyp-rpath.patch b/external/nss/gyp-rpath.patch
deleted file mode 100644
index d918584c9745..000000000000
--- a/external/nss/gyp-rpath.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- pylib/gyp/generator/ninja.py
-+++ pylib/gyp/generator/ninja.py
-@@ -1241,6 +1241,8 @@
-         else:
-           ldflags.append('-Wl,-rpath=%s' % self.target_rpath)
-         ldflags.append('-Wl,-rpath-link=%s' % rpath)
-+      elif not is_executable:
-+        ldflags.append('-Wl,-rpath=\$$ORIGIN')
-     self.WriteVariableList(ninja_file, 'ldflags',
-                            map(self.ExpandSpecial, ldflags))
- 
-
diff --git a/external/nss/nsinstall.py b/external/nss/nsinstall.py
index b73587dd9745..31b3de3450c5 100755..100644
--- a/external/nss/nsinstall.py
+++ b/external/nss/nsinstall.py
@@ -1,4 +1,3 @@
-#! /usr/bin/env python
 # ***** BEGIN LICENSE BLOCK *****
 # Version: MPL 1.1/GPL 2.0/LGPL 2.1
 #
diff --git a/external/nss/nss-online.patch.0 b/external/nss/nss-online.patch.0
deleted file mode 100644
index b84a15cc393a..000000000000
--- a/external/nss/nss-online.patch.0
+++ /dev/null
@@ -1,11 +0,0 @@
---- nss/lib/softoken/softoken.h.orig	2020-03-25 18:51:38.786887278 +0100
-+++ nss/lib/softoken/softoken.h	2020-03-25 18:51:47.450997085 +0100
-@@ -145,7 +145,7 @@
- /*
- ** macros to check for forked child process after C_Initialize
- */
--#if defined(XP_UNIX) && !defined(NO_FORK_CHECK)
-+#if 0
- 
- #ifdef DEBUG
- 
diff --git a/external/nss/python-cygwin-template b/external/nss/python-cygwin-template
deleted file mode 100644
index baf437f5960c..000000000000
--- a/external/nss/python-cygwin-template
+++ /dev/null
@@ -1,24 +0,0 @@
-#! /bin/bash
-args=()
-# convert to Windows paths
-while test -n "$1"; do
-    # convert path in each argument, if needed
-    if [[ "$1" =~ -(.*)=(.*) ]]; then # -option=value
-        arg=$(cygpath -w -- "${BASH_REMATCH[2]}" 2>/dev/null)
-        if test -n "$arg"; then # value is a path
-            args+=("-${BASH_REMATCH[1]}=$arg")
-        else
-            args+=("$1")
-        fi
-    else
-        arg=$(cygpath -w -- "$1" 2>/dev/null)
-        if test -n "$arg"; then
-            args+=("$arg")
-        else
-            args+=("$1")
-        fi
-    fi
-    shift
-done
-PATH=$(cygpath -w -p "$PATH")
-# here belongs a line invoking python with ${args[@]} as arguments
diff --git a/external/nss/setup-python b/external/nss/setup-python
deleted file mode 100755
index 7f4d367c8602..000000000000
--- a/external/nss/setup-python
+++ /dev/null
@@ -1,3 +0,0 @@
-#! /bin/sh
-# need to run using our python wrapper to set up python env. vars, for python calls from ninja
-python -c "import sys; import subprocess; args=sys.argv; args.pop(0); args.pop(0); sys.exit(subprocess.call(args))" -- "$@"