Split the nssckbi target off from the 'nss' target.

nss.gyp

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 {
   'variables': {
     'exclude_nss_root_certs%': 1,
     'exclude_nss_libpkix%': 1,
   },
   'target_defaults': {
@@ skipping 311 matching lines @@
             '-Wno-incompatible-pointer-types',
             '-Wno-pointer-sign',
           ],
         }],
       ],
     },
     {
       'target_name': 'nss',
       'product_name': 'crnss',
       'type': '<(component)',
+      'dependencies': [
+        'nss_static',
+      ],
+      'export_dependent_settings': [
+        'nss_static',
+      ],
+      'sources': [
+        'mozilla/security/nss/lib/nss/nssver.c',

[wtc, 2012/05/16 19:45:10]

It would be nice to add a comment to explain why the nss
target contains only this file from the NSS source tree.
From your original CL:

  A bit of a hack to ensure at least one symbol is linked
  in to the target. MSVC gets grumpy if a target has no
  linkables but tries to produce a DLL (line 344)

+      ],
+      'conditions': [
+        ['exclude_nss_root_certs==0', {
+          'dependencies': [
+            'nssckbi',
+          ],
+          'export_dependent_settings': [
+            'nssckbi',
+          ],
+        }],
+        ['OS == "mac" and component == "shared_library"', {
+          'xcode_settings': {
+            'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',  # no -fvisibility=hidden
+          },
+        }],
+        ['OS == "win" and component == "shared_library"', {
+          'sources': [
+            'mozilla/security/nss/exports_win.def',
+          ],
+        }],
+      ],
+    },
+    {
+      # This is really more of a pseudo-target to work around the fact that
+      # a single static_library target cannot contain two object files of the
+      # same name (hash.o / hash.obj). Logically, this is part of the
+      # 'nss_static' target. By separating it out, it creates a possible
+      # circular dependency between 'nss_static' and 'nssckbi' when
+      # 'exclude_nss_root_certs' is not specified, as 'nss_static' depends on
+      # the 'builtinsC_GetFunctionList' exported by this target. This is an
+      # artifact of how NSS is being statically built, which is not an
+      # officially supported configuration - normally, 'nssckbi.dll/so' would
+      # depend on libnss3.dll/so, and the higher layer caller would instruct
+      # libnss3.dll to dynamically load nssckbi.dll, breaking the circle.
+      #
+      # TODO(rsleevi): http://crbug.com/128134 - Break the circular dependency
+      # without requiring nssckbi to be built as a shared library.
+      'target_name': 'nssckbi',
+      'product_name': 'crnssckbi',
+      'type': 'static_library',
+      'sources': [
+        'mozilla/security/nss/lib/ckfw/builtins/anchor.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bfind.c',
+        'mozilla/security/nss/lib/ckfw/builtins/binst.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bobject.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bsession.c',
+        'mozilla/security/nss/lib/ckfw/builtins/bslot.c',
+        'mozilla/security/nss/lib/ckfw/builtins/btoken.c',
+        'mozilla/security/nss/lib/ckfw/builtins/builtins.h',
+        'mozilla/security/nss/lib/ckfw/builtins/certdata.c',
+        'mozilla/security/nss/lib/ckfw/builtins/ckbiver.c',
+        'mozilla/security/nss/lib/ckfw/builtins/constants.c',
+        'mozilla/security/nss/lib/ckfw/builtins/nssckbi.h',
+        'mozilla/security/nss/lib/ckfw/ck.h',
+        'mozilla/security/nss/lib/ckfw/ckfw.h',
+        'mozilla/security/nss/lib/ckfw/ckfwm.h',
+        'mozilla/security/nss/lib/ckfw/ckfwtm.h',
+        'mozilla/security/nss/lib/ckfw/ckmd.h',
+        'mozilla/security/nss/lib/ckfw/ckt.h',
+        'mozilla/security/nss/lib/ckfw/crypto.c',
+        'mozilla/security/nss/lib/ckfw/find.c',
+        'mozilla/security/nss/lib/ckfw/hash.c',
+        'mozilla/security/nss/lib/ckfw/instance.c',
+        'mozilla/security/nss/lib/ckfw/mechanism.c',
+        'mozilla/security/nss/lib/ckfw/mutex.c',
+        'mozilla/security/nss/lib/ckfw/nssck.api',
+        'mozilla/security/nss/lib/ckfw/nssckepv.h',
+        'mozilla/security/nss/lib/ckfw/nssckft.h',
+        'mozilla/security/nss/lib/ckfw/nssckfw.h',
+        'mozilla/security/nss/lib/ckfw/nssckfwc.h',
+        'mozilla/security/nss/lib/ckfw/nssckfwt.h',
+        'mozilla/security/nss/lib/ckfw/nssckg.h',
+        'mozilla/security/nss/lib/ckfw/nssckmdt.h',
+        'mozilla/security/nss/lib/ckfw/nssckt.h',
+        'mozilla/security/nss/lib/ckfw/object.c',
+        'mozilla/security/nss/lib/ckfw/session.c',
+        'mozilla/security/nss/lib/ckfw/sessobj.c',
+        'mozilla/security/nss/lib/ckfw/slot.c',
+        'mozilla/security/nss/lib/ckfw/token.c',
+        'mozilla/security/nss/lib/ckfw/wrap.c',
+      ],
+      'dependencies': [
+        'nss_static',
+      ],
+      'export_dependent_settings': [
+        'nss_static',
+      ],
+      'include_dirs': [
+        'mozilla/security/nss/lib/ckfw',
+      ],
+      'direct_dependent_settings': {
+        'include_dirs': [
+          'mozilla/security/nss/lib/ckfw/builtins',
+        ],
+      },
+    },
+    {
+      'target_name': 'nss_static',
+      'type': 'static_library',
       'sources': [
         'mozilla/security/nss/lib/base/arena.c',
         'mozilla/security/nss/lib/base/base.h',
         'mozilla/security/nss/lib/base/baset.h',
         'mozilla/security/nss/lib/base/error.c',
         'mozilla/security/nss/lib/base/errorval.c',
         'mozilla/security/nss/lib/base/hash.c',
         'mozilla/security/nss/lib/base/hashops.c',
         'mozilla/security/nss/lib/base/item.c',
         'mozilla/security/nss/lib/base/libc.c',
@@ skipping 27 matching lines @@
         'mozilla/security/nss/lib/certhigh/certvfy.c',
         'mozilla/security/nss/lib/certhigh/certvfypkix.c',
         'mozilla/security/nss/lib/certhigh/certvfypkixprint.c',
         'mozilla/security/nss/lib/certhigh/crlv2.c',
         'mozilla/security/nss/lib/certhigh/ocsp.c',
         'mozilla/security/nss/lib/certhigh/ocsp.h',
         'mozilla/security/nss/lib/certhigh/ocspi.h',
         'mozilla/security/nss/lib/certhigh/ocspt.h',
         'mozilla/security/nss/lib/certhigh/ocspti.h',
         'mozilla/security/nss/lib/certhigh/xcrldist.c',
-        'mozilla/security/nss/lib/ckfw/builtins/anchor.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bfind.c',
-        'mozilla/security/nss/lib/ckfw/builtins/binst.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bobject.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bsession.c',
-        'mozilla/security/nss/lib/ckfw/builtins/bslot.c',
-        'mozilla/security/nss/lib/ckfw/builtins/btoken.c',
-        'mozilla/security/nss/lib/ckfw/builtins/builtins.h',
-        'mozilla/security/nss/lib/ckfw/builtins/certdata.c',
-        'mozilla/security/nss/lib/ckfw/builtins/ckbiver.c',
-        'mozilla/security/nss/lib/ckfw/builtins/constants.c',
-        'mozilla/security/nss/lib/ckfw/builtins/nssckbi.h',
-        'mozilla/security/nss/lib/ckfw/ck.h',
-        'mozilla/security/nss/lib/ckfw/ckfw.h',
-        'mozilla/security/nss/lib/ckfw/ckfwm.h',
-        'mozilla/security/nss/lib/ckfw/ckfwtm.h',
-        'mozilla/security/nss/lib/ckfw/ckmd.h',
-        'mozilla/security/nss/lib/ckfw/ckt.h',
-        'mozilla/security/nss/lib/ckfw/crypto.c',
-        'mozilla/security/nss/lib/ckfw/find.c',
-        'mozilla/security/nss/lib/ckfw/hash.c',
-        'mozilla/security/nss/lib/ckfw/instance.c',
-        'mozilla/security/nss/lib/ckfw/mechanism.c',
-        'mozilla/security/nss/lib/ckfw/mutex.c',
-        'mozilla/security/nss/lib/ckfw/nssck.api',
-        'mozilla/security/nss/lib/ckfw/nssckepv.h',
-        'mozilla/security/nss/lib/ckfw/nssckft.h',
-        'mozilla/security/nss/lib/ckfw/nssckfw.h',
-        'mozilla/security/nss/lib/ckfw/nssckfwc.h',
-        'mozilla/security/nss/lib/ckfw/nssckfwt.h',
-        'mozilla/security/nss/lib/ckfw/nssckg.h',
-        'mozilla/security/nss/lib/ckfw/nssckmdt.h',
-        'mozilla/security/nss/lib/ckfw/nssckt.h',
-        'mozilla/security/nss/lib/ckfw/object.c',
-        'mozilla/security/nss/lib/ckfw/session.c',
-        'mozilla/security/nss/lib/ckfw/sessobj.c',
-        'mozilla/security/nss/lib/ckfw/slot.c',
-        'mozilla/security/nss/lib/ckfw/token.c',
-        'mozilla/security/nss/lib/ckfw/wrap.c',
         'mozilla/security/nss/lib/cryptohi/cryptohi.h',
         'mozilla/security/nss/lib/cryptohi/cryptoht.h',
         'mozilla/security/nss/lib/cryptohi/dsautil.c',
         'mozilla/security/nss/lib/cryptohi/key.h',
         'mozilla/security/nss/lib/cryptohi/keyhi.h',
         'mozilla/security/nss/lib/cryptohi/keyi.h',
         'mozilla/security/nss/lib/cryptohi/keyt.h',
         'mozilla/security/nss/lib/cryptohi/keythi.h',
         'mozilla/security/nss/lib/cryptohi/sechash.c',
         'mozilla/security/nss/lib/cryptohi/seckey.c',
@@ skipping 248 matching lines @@
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_oid.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_primhash.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_primhash.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_rwlock.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_rwlock.h',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_string.c',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system/pkix_pl_string.h',
         'mozilla/security/nss/lib/nss/nss.h',
         'mozilla/security/nss/lib/nss/nssinit.c',
         'mozilla/security/nss/lib/nss/nssrenam.h',
-        'mozilla/security/nss/lib/nss/nssver.c',
         'mozilla/security/nss/lib/nss/utilwrap.c',
         'mozilla/security/nss/lib/pk11wrap/debug_module.c',
         'mozilla/security/nss/lib/pk11wrap/dev3hack.c',
         'mozilla/security/nss/lib/pk11wrap/dev3hack.h',
         'mozilla/security/nss/lib/pk11wrap/pk11akey.c',
         'mozilla/security/nss/lib/pk11wrap/pk11auth.c',
         'mozilla/security/nss/lib/pk11wrap/pk11cert.c',
         'mozilla/security/nss/lib/pk11wrap/pk11cxt.c',
         'mozilla/security/nss/lib/pk11wrap/pk11err.c',
         'mozilla/security/nss/lib/pk11wrap/pk11func.h',
@@ skipping 149 matching lines @@
       ],
       'sources!': [
         # primes.c is included by mpprime.c.
         'mozilla/security/nss/lib/freebl/mpi/primes.c',
         # unix_rand.c and win_rand.c are included by sysrand.c.
         'mozilla/security/nss/lib/freebl/unix_rand.c',
         'mozilla/security/nss/lib/freebl/win_rand.c',
         # debug_module.c is included by pk11load.c.
         'mozilla/security/nss/lib/pk11wrap/debug_module.c',
       ],
+      'dependencies': [
+        'nspr',
+        '../sqlite/sqlite.gyp:sqlite',
+      ],
+      'export_dependent_settings': [
+        'nspr',
+      ],
       'defines': [
+        'MP_API_COMPATIBLE',
+        'NSS_DISABLE_DBM',
         'NSS_ENABLE_ECC',
-        'USE_UTIL_DIRECTLY',
-        'MP_API_COMPATIBLE',
-        'RIJNDAEL_INCLUDE_TABLES',
-        'NSS_DISABLE_DBM',
         'NSS_STATIC',
         'NSS_USE_STATIC_LIBS',
+        'RIJNDAEL_INCLUDE_TABLES',
         'SHLIB_VERSION=\"3\"',
         'SOFTOKEN_SHLIB_VERSION=\"3\"',
+        'USE_UTIL_DIRECTLY',
       ],
       'defines!': [
         # Regrettably, NSS can't be compiled with NO_NSPR_10_SUPPORT yet.
         'NO_NSPR_10_SUPPORT',
       ],
       'include_dirs': [
         'mozilla/security/nss/lib/base',
         'mozilla/security/nss/lib/certdb',
         'mozilla/security/nss/lib/certhigh',
-        'mozilla/security/nss/lib/ckfw',
         'mozilla/security/nss/lib/cryptohi',
         'mozilla/security/nss/lib/dev',
         'mozilla/security/nss/lib/freebl',
         'mozilla/security/nss/lib/freebl/ecl',
         'mozilla/security/nss/lib/freebl/mpi',
         'mozilla/security/nss/lib/libpkix/include',
         'mozilla/security/nss/lib/libpkix/pkix/certsel',
         'mozilla/security/nss/lib/libpkix/pkix/checker',
         'mozilla/security/nss/lib/libpkix/pkix/crlsel',
         'mozilla/security/nss/lib/libpkix/pkix/params',
         'mozilla/security/nss/lib/libpkix/pkix/results',
         'mozilla/security/nss/lib/libpkix/pkix/store',
         'mozilla/security/nss/lib/libpkix/pkix/top',
         'mozilla/security/nss/lib/libpkix/pkix/util',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/module',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/pki',
         'mozilla/security/nss/lib/libpkix/pkix_pl_nss/system',
         'mozilla/security/nss/lib/nss',
         'mozilla/security/nss/lib/pk11wrap',
         'mozilla/security/nss/lib/pkcs7',
         'mozilla/security/nss/lib/pki',
         'mozilla/security/nss/lib/smime',
         'mozilla/security/nss/lib/softoken',
         'mozilla/security/nss/lib/ssl',
         'mozilla/security/nss/lib/util',
       ],
-      'dependencies': [
-        'nspr',
-        '../sqlite/sqlite.gyp:sqlite',
-      ],
       'direct_dependent_settings': {
         'defines': [
-          'NO_NSPR_10_SUPPORT',
+          'NSS_ENABLE_ECC',
           'NSS_STATIC',
           'NSS_USE_STATIC_LIBS',
           'USE_UTIL_DIRECTLY',
         ],
         'include_dirs': [
           'mozilla/nsprpub/pr/include',
           'mozilla/nsprpub/lib/ds',
           'mozilla/nsprpub/lib/libc/include',
           'mozilla/security/nss/lib/base',
           'mozilla/security/nss/lib/certdb',
@@ skipping 10 matching lines @@
           'mozilla/security/nss/lib/softoken',
           'mozilla/security/nss/lib/util',
         ],
       },
       'msvs_disabled_warnings': [4018, 4101],
       'conditions': [
         ['exclude_nss_root_certs==1', {
           'defines': [
             'NSS_DISABLE_ROOT_CERTS',
           ],
-          'sources/': [
-            ['exclude', '^mozilla/security/nss/lib/ckfw/'],
-          ],
-          'include_dirs!': [
-            'mozilla/security/nss/lib/ckfw',
-          ],
         }],
         ['exclude_nss_libpkix==1', {
           'defines': [
             'NSS_DISABLE_LIBPKIX',
           ],
           'sources/': [
             ['exclude', '^mozilla/security/nss/lib/libpkix/'],
           ],
           'sources!': [
             'mozilla/security/nss/lib/certhigh/certvfypkix.c',
@@ skipping 30 matching lines @@
               'NSS_X86',
               'i386',
             ],
             'GCC_PREPROCESSOR_DEFINITIONS[arch=x86_64]': [
               '$(inherited)',
               'NSS_USE_64',
               'NSS_X86_OR_X64',
               'NSS_X64',
             ],
           },
-          'conditions': [
-            ['component == "shared_library"', {
-              'xcode_settings': {
-                'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',  # no -fvisibility=hidden
-              },
-            }],
-          ],
         }],
         ['OS=="win"', {
           'defines': [
-            'XP_PC',
-            'WIN32',
-            '_WINDOWS',
-            'WIN95',
             'SHLIB_SUFFIX=\"dll\"',
             'SHLIB_PREFIX=\"\"',
             'SOFTOKEN_LIB_NAME=\"softokn3.dll\"',
+            'XP_PC',
+            'WIN32',
+            'WIN95',
+            '_WINDOWS',
           ],
+          'direct_dependent_settings': {
+            'defines': [
+              '_WINDOWS',
+            ],
+          },
           'conditions': [
             ['target_arch=="ia32"', {
               'defines': [
                 'NSS_X86_OR_X64',
                 'NSS_X86',
                 '_X86_',
                 'MP_ASSEMBLY_MULTIPLY',
                 'MP_ASSEMBLY_SQUARE',
                 'MP_ASSEMBLY_DIV_2DX1D',
                 'MP_USE_UINT_DIGIT',
                 'MP_NO_MP_WORD',
               ],
             }],
-            ['component == "shared_library"', {
-              'sources': [
-                'mozilla/security/nss/exports_win.def',
-              ],
-            }],
           ],
         }],
         ['clang==1', {
           'xcode_settings': {
             'WARNING_CFLAGS': [
               # nss doesn't explicitly cast between different enum types.
               '-Wno-conversion',
               # nss passes "const char*" through "void*".
               '-Wno-incompatible-pointer-types',
               # nss prefers `a && b || c` over `(a && b) || c`.
               '-Wno-logical-op-parentheses',
               # nss doesn't use exhaustive switches on enums
               '-Wno-switch',
               # nss has some `unsigned < 0` checks.
               '-Wno-tautological-compare',
             ],
           },
           'cflags': [
             '-Wno-conversion',
             '-Wno-incompatible-pointer-types',
             '-Wno-logical-op-parentheses',
             '-Wno-switch',
             '-Wno-tautological-compare',
           ],
         }],
       ],
     },
   ],
 }