gitlab-ci: add an NSS check.

.gitlab-ci.yml

@@ -89,6 +89,7 @@ variables:
     - if [ "$DOXYGEN" = yes ]; then apt-get install doxygen; fi
     - if [ "$STEM" = yes ]; then apt-get install timelimit; fi
     - if [ "$CC" = clang ]; then apt-get install clang; fi
+    - if [ "$NSS" = yes ]; then apt-get install libnss3 libnss3-dev; fi
     # TODO: This next line should not be debian-only.
     - if [ "$STEM" = yes ]; then git clone --depth 1 https://git.torproject.org/stem.git ; export STEM_PATH="$(pwd)/stem"; fi
     # TODO: This next line should not be debian-only.
@@ -214,3 +215,13 @@ debian-disable-relay:
     - if: '$CI_PIPELINE_SOURCE == "push"'
       exists:
         - src/feature/relay/relay_stub.c
+
+#####
+# NSS check on debian
+debian-nss:
+  image: debian:stable
+  <<: *debian-template
+  variables:
+    NSS: "yes"
+  script:
+    - ./scripts/ci/ci-driver.sh