1277255 - Upgrade Firefox 49 to NSS 3.25

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Kai Engert (:KaiE:)]

Firefox 49 should use NSS 3.25, which is currently being worked on.

Comment 1

[Kai Engert (:KaiE:)]

Try build with today's snapshot 765c0adb71b7
https://treeherder.mozilla.org/#/jobs?repo=try&revision=d6d705067fc8

Comment 2

[Franziskus Kiefer [:franziskus]]

I'm a bit concerned about the Win7 cl tests failing. But I don't see any relation to NSS there so I think we should be good to land a beta.

Comment 3

[:Cykesiopka]

(In reply to Franziskus Kiefer [:fkiefer or :franziskus] from comment #2)
> I'm a bit concerned about the Win7 cl tests failing. But I don't see any
> relation to NSS there so I think we should be good to land a beta.

That's Bug 1270962.
tl;dr - Win7 VM instances (ones with spot in the machine name) currently can't run clipboard related tests successfully. In this case, all the M-cl tests failures are in fact on spot machines, so the try push looks fine.

(On a side note, it might be a good idea to exclude things like Reftests in future NSS try pushes as well, since those tests test code that have zero relation to NSS.)

Comment 4

[Kai Engert (:KaiE:)]

(In reply to :Cykesiopka from comment #3)
> 
> (On a side note, it might be a good idea to exclude things like Reftests in
> future NSS try pushes as well, since those tests test code that have zero
> relation to NSS.)

Anything else that should be excluded? Would you like to recommend a complete trychooser parameter that seems reasonable for NSS try runs?

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Maybe something like "try: -b do -p all -u xpcshell,cppunit,gtest,mochitests -t none"?

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a2f23b6058a2
land NSS_3_25_BETA1, r=franziskus

Comment 7

[:Cykesiopka]

(In reply to David Keeler [:keeler] (use needinfo?) from comment #5)
> Maybe something like "try: -b do -p all -u xpcshell,cppunit,gtest,mochitests
> -t none"?

Yeah, that looks reasonable.

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/a2f23b6058a2

Comment 9

[Mike Hommey [:glandium]]

the configure check was not updated, while nsNSSCallbacks.cpp uses new values (TLS_ECDHE_*_WITH_AES_256_GCM_SHA384)

Comment 10

[Masatoshi Kimura [:emk]]

(In reply to Mike Hommey [:glandium] from comment #9)
> the configure check was not updated, while nsNSSCallbacks.cpp uses new
> values (TLS_ECDHE_*_WITH_AES_256_GCM_SHA384)

What is "the configure check"? What happens if it is not updated?

Comment 11

[Mike Hommey [:glandium]]

(In reply to Masatoshi Kimura [:emk] from comment #10)
> (In reply to Mike Hommey [:glandium] from comment #9)
> > the configure check was not updated, while nsNSSCallbacks.cpp uses new
> > values (TLS_ECDHE_*_WITH_AES_256_GCM_SHA384)
> 
> What is "the configure check"?

https://dxr.mozilla.org/mozilla-central/rev/b6f7d0eb61b1878d3d906bd231edf225463ece3f/old-configure.in#2469

> What happens if it is not updated?

Build failure against system NSS between 3.23 (currently checked minimal version) and 3.25 (better to fail during configure than during the build).

Comment 12

[Masatoshi Kimura [:emk]]

Per ChaCha20/Poly1305 precedent[1], we will update the configure check when NSS 3.25 RTM is merged to m-c.

[1] https://hg.mozilla.org/mozilla-central/rev/5e135136e21c

Comment 13

[Mike Hommey [:glandium]]

(In reply to Masatoshi Kimura [:emk] from comment #12)
> Per ChaCha20/Poly1305 precedent[1], we will update the configure check when
> NSS 3.25 RTM is merged to m-c.
> 
> [1] https://hg.mozilla.org/mozilla-central/rev/5e135136e21c

That's backwards. Building aurora *is* broken with versions that pass configure.

Comment 14

[Franziskus Kiefer [:franziskus]]

Attachment: NSS_3.25_RC0.patch

Tim, could you land this?
try run is at [1]

[1] https://treeherder.mozilla.org/#/jobs?repo=try&revision=f601aeda21cf092ee332a077555364b93c307ad6

Comment 15

[Martin Thomson [:mt:]]

Comment on attachment 8762370 [details] [diff] [review]
NSS_3.25_RC0.patch

Review of attachment 8762370 [details] [diff] [review]:
-----------------------------------------------------------------

There are a few other files that need changing in the tree I think.  Kai usually just asks for review on a version number and we land the changes using the scripts.

Comment 16

[Franziskus Kiefer [:franziskus]]

(In reply to Martin Thomson [:mt:] from comment #15)
> Comment on attachment 8762370 [details] [diff] [review]
> NSS_3.25_RC0.patch
> 
> Review of attachment 8762370 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> There are a few other files that need changing in the tree I think.  Kai
> usually just asks for review on a version number and we land the changes
> using the scripts.

This should contain everything (the patch is created using the scripts). I'd have landed it if I'd have commit access... So I'll just leave this here until someone lands it or tells me what else to change.

Comment 17

[Kai Engert (:KaiE:)]

Comment on attachment 8762370 [details] [diff] [review]
NSS_3.25_RC0.patch

r-

I just ran command
  python client.py update_nss NSS_3_25_RC0
against mozilla-inbound, and the result contains several differences when compared to this patch, although both patches (your and mine) claim to be the diff between tag beta1 and rc0.

It seems something went wrong when preparing this patch.

Comment 18

[Kai Engert (:KaiE:)]

Attachment: Command to upgrade-to-325rc0

Comment 19

[Kai Engert (:KaiE:)]

Attachment: bump-configure-to-3.25.patch

Comment 20

[Kai Engert (:KaiE:)]

(In reply to Kai Engert (:kaie) from comment #17)
> I just ran command
>   python client.py update_nss NSS_3_25_RC0
> against mozilla-inbound, and the result contains several differences when
> compared to this patch, although both patches (your and mine) claim to be
> the diff between tag beta1 and rc0.
> 
> It seems something went wrong when preparing this patch.

Ok, that's interesting.

I was wrong.

Although the patches look different, the difference is simply caused by the order of removal and insertion statements in the patch.

I confirmed that Franziskus' patch produces the identical output than the command I attached.

Comment 21

[Kai Engert (:KaiE:)]

Comment on attachment 8762370 [details] [diff] [review]
NSS_3.25_RC0.patch

Changing my earlier r- to an r+ as explained

Comment 22

[Kai Engert (:KaiE:)]

Comment on attachment 8762542 [details] [diff] [review]
bump-configure-to-3.25.patch

r=franziskus on IRC

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/bb5316a4c7c2
land NSS_3_25_RC0, r=kaie
https://hg.mozilla.org/integration/mozilla-inbound/rev/3a53ff76208b
bump configure to require NSS 3.25, r=franziskus

Comment 24

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/bb5316a4c7c2
https://hg.mozilla.org/mozilla-central/rev/3a53ff76208b

Comment 25

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c4be443b20d0
land NSS_3_25_RC1, r=me

Comment 26

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c4be443b20d0

Comment 27

[Kai Engert (:KaiE:)]

Attachment: upgrade-to-325rtm

Aurora 49 uses a beta version of NSS.

We must upgrade it to the final release tag.

This is a placeholder attachment, which lists the command used to uplift the RTM tag.

Comment 28

[Kai Engert (:KaiE:)]

Comment on attachment 8762542 [details] [diff] [review]
bump-configure-to-3.25.patch

This patch adjusts the configuration script to require the newer NSS version at build time.

Comment 29

[Liz Henry (:lizzard) (relman/hg->git project)]

Comment on attachment 8764553 [details]
upgrade-to-325rtm

We want to make sure to release the non-beta version; please uplift this to aurora.

Comment 30

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/f20f82876561

Comment 31

[Kai Engert (:KaiE:)]

Thank you