2 files changed, 79 insertions, 0 deletions

diff --git a/meta/recipes-extended/libnss-nis/libnss-nis.bb b/meta/recipes-extended/libnss-nis/libnss-nis.bb
index 2198606de5..a7f6545be0 100644
--- a/meta/recipes-extended/libnss-nis/libnss-nis.bb
+++ b/meta/recipes-extended/libnss-nis/libnss-nis.bb
@@ -18,6 +18,7 @@ PV = "3.2"
 SRCREV = "cd0d391af9535b56e612ed227c1b89be269f3d59"
 
 SRC_URI = "git://github.com/thkukuk/libnss_nis;branch=master;protocol=https \
+           file://0001-make-ake-_nss_nis_getsecretkey-export-conditional-on.patch \
           "
 
 inherit autotools pkgconfig
diff --git a/meta/recipes-extended/libnss-nis/libnss-nis/0001-make-ake-_nss_nis_getsecretkey-export-conditional-on.patch b/meta/recipes-extended/libnss-nis/libnss-nis/0001-make-ake-_nss_nis_getsecretkey-export-conditional-on.patch
new file mode 100644
index 0000000000..b9996d3292
--- /dev/null
+++ b/meta/recipes-extended/libnss-nis/libnss-nis/0001-make-ake-_nss_nis_getsecretkey-export-conditional-on.patch
@@ -0,0 +1,78 @@
+From ecc9767fd8c3a1ecbfca5df18714df34995a38a3 Mon Sep 17 00:00:00 2001
+From: Khem Raj <raj.khem@gmail.com>
+Date: Tue, 26 Aug 2025 22:45:54 -0700
+Subject: [PATCH] make: Make _nss_nis_getsecretkey export conditional on xdecrypt()
+
+The function _nss_nis_getsecretkey in nis-publickey.c is only
+compiled when xdecrypt() is available. This is controlled by the
+configure check AC_CHECK_FUNCS([xdecrypt]) which defines
+HAVE_XDECRYPT in config.h.
+
+However, the symbol was always listed in src/libnss_nis.map,
+regardless of whether the function was actually built. On systems
+without xdecrypt() (for example musl or certain embedded toolchains),
+this leads to a link failure:
+
+    ld: error: version script assignment of 'NSS_NIS_1.0' to symbol
+    '_nss_nis_getsecretkey' failed: symbol not defined
+
+To fix this mismatch, rename libnss_nis.map to
+libnss_nis.map.in and generate libnss_nis.map at build time:
+
+ - If HAVE_XDECRYPT is defined, the symbol map is copied unchanged.
+ - Otherwise, the _nss_nis_getsecretkey line is stripped out
+   with sed.
+
+Automake rules are added to src/Makefile.am so the correct
+libnss_nis.map is produced, and the linker always sees a version
+script consistent with the compiled objects.
+
+This ensures _nss_nis_getsecretkey is exported only when it exists
+in the object code, preventing build failures on platforms where
+xdecrypt() is missing.
+
+This fixes build with LLD linker which defaults to not accepting
+undefined symbols
+
+Upstream-Status: Submitted [https://github.com/thkukuk/libnss_nis/pull/12]
+Signed-off-by: Khem Raj <raj.khem@gmail.com>
+---
+ src/Makefile.am                           | 18 +++++++++++++++++-
+ src/{libnss_nis.map => libnss_nis.map.in} |  0
+ 2 files changed, 17 insertions(+), 1 deletion(-)
+ rename src/{libnss_nis.map => libnss_nis.map.in} (100%)
+
+diff --git a/src/Makefile.am b/src/Makefile.am
+index e1a9bb2..cc32ea9 100644
+--- a/src/Makefile.am
++++ b/src/Makefile.am
+@@ -22,8 +22,24 @@ nss_loader_test_LDADD = -ldl
+ 
+ TESTS = $(check_PROGRAMS)
+ 
++# Build the version script from a template, pruning _nss_nis_getsecretkey
++# when xdecrypt() was not detected by configure (i.e., HAVE_XDECRYPT is unset).
++BUILT_SOURCES = libnss_nis.map
++EXTRA_DIST   += libnss_nis.map.in
++CLEANFILES   += libnss_nis.map
++
++libnss_nis.map: $(srcdir)/libnss_nis.map.in $(top_builddir)/config.h
++       $(AM_V_GEN) { \
++         if grep -q '^[[:space:]]*#define[[:space:]]\+HAVE_XDECRYPT[[:space:]]\+1' $(top_builddir)/config.h ; then \
++           cp $(srcdir)/libnss_nis.map.in $@ ; \
++         else \
++           sed 's/ _nss_nis_getsecretkey;//g' \
++               $(srcdir)/libnss_nis.map.in > $@ ; \
++         fi ; \
++       }
++
+ libnss_nis_la_LDFLAGS = -version-info 2:0:0 \
+-       -Wl,--version-script=$(srcdir)/libnss_nis.map
++       -Wl,--version-script=$(builddir)/libnss_nis.map
+ libnss_nis_la_LIBADD = @LIBNSL_LIBS@
+ libnss_nis_la_SOURCES = nis-alias.c nis-ethers.c nis-grp.c nis-hosts.c \
+                        nis-initgroups.c nis-netgrp.c nis-network.c  \
+diff --git a/src/libnss_nis.map b/src/libnss_nis.map.in
+similarity index 100%
+rename from src/libnss_nis.map
+rename to src/libnss_nis.map.in