451305 - (ev303) Enable additional EV roots for FF 3.0.4

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert (:KaiE:)]

There are some EV roots queued up that should get enabled in the next round of updates.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Patch, part 1

In order to fix this bug, two steps are necessary.

First, we must deliver a new snapshot of NSS into Mozilla 1.9.0, a snapshot which includes the new root from bug 450427 (only a single new root for this round).

After talking to Samuel, we had agreed to use the minimal approach, do not add new NSS code at this point of time, but only the new root(s).

I've complied with this plan, and we produced a new NSS snapshot accordingly.

Please approve the attached file.
The NSS import action described is equivalent to accepting the patch from bug 450427.

Thanks.


Once done, the second part will be the Mozilla application code level patch from bug 450429, review pending.

Comment 2

[Kai Engert (:KaiE:)]

Comment on attachment 344023 [details] [diff] [review]
Patch, part 1

Samuel, this is what we had agreed to do, IIUC.

Comment 3

[Kai Engert (:KaiE:)]

Comment on attachment 344023 [details] [diff] [review]
Patch, part 1

Nelson or Wan-Teh, can you please r+ delivering this updated tag to Mozilla (for Firefox 3.0.x stable branch)?

Note to release-drivers, this has already been agreed on earlier in email, I'm only requesting this review to follow procedures, should you be waiting for the r+.

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

I don't understand the difference between this bug and bug 461082.
What is one of these intended to do that the other is not intended to do?

Comment 5

[Kai Engert (:KaiE:)]

(In reply to comment #4)
> I don't understand the difference between this bug and bug 461082.
> What is one of these intended to do that the other is not intended to do?

Nelson, bug 461082 is about NSS 3.12.2, but delivering of this updated NSS version has been denied by Samuel Sidler, as we're too late for Firefox 3.0.4

This is why I have produced the NSS 3.12.1 + new root snapshot, which is tagged as NSS_3_12_1_WITH_CBKI_1_72_RTM.

NSS_3_12_1_WITH_CBKI_1_72_RTM for Firefox 3.0.4

NSS 3.12.2 for Firefox 3.0.5

Comment 6

[Wan-Teh Chang]

Comment on attachment 344023 [details] [diff] [review]
Patch, part 1

r=wtc.

>Update NSS used in Mozilla 1.9.0 branch
>from current NSS_3_12_1_RTM to
>NSS_3_12_1_WITH_CBKI_1_72_RTM.

"CBKI" should be "CKBI".

Comment 7

[Kai Engert (:KaiE:)]

Comment on attachment 344023 [details] [diff] [review]
Patch, part 1

(In reply to comment #6)
> r=wtc.
> 
> "CBKI" should be "CKBI".

Yes, this was a typo, thanks Wan-Teh!

This patch is named "part 1".

Part 2 is attachment 343489 [details] [diff] [review] from bug 450429.

Comment 8

[Daniel Veditz [:dveditz]]

Comment on attachment 344023 [details] [diff] [review]
Patch, part 1

I don't get this, don't we need an actual patch to change the tag in client.mk?

Comment 9

[Kai Engert (:KaiE:)]

(In reply to comment #8)
> (From update of attachment 344023 [details] [diff] [review])
> I don't get this, don't we need an actual patch to change the tag in client.mk?

Sorry, my thinking was too hg centric already.

I'll attach the patch in two minutes.

Comment 10

[Kai Engert (:KaiE:)]

Attachment: Patch, Update Mozilla 1.9.0 to NSS_3_12_1_WITH_CKBI_1_72_RTM

Comment 11

[Samuel Sidler (old account; do not CC)]

Comment on attachment 344387 [details] [diff] [review]
Patch, Update Mozilla 1.9.0 to NSS_3_12_1_WITH_CKBI_1_72_RTM

Approved for 1.9.0.4. a=ss for release-drivers.

Comment 12

[Kai Engert (:KaiE:)]

Comment on attachment 344387 [details] [diff] [review]
Patch, Update Mozilla 1.9.0 to NSS_3_12_1_WITH_CKBI_1_72_RTM

Checked in to cvs trunk for 1.9.0.4

Checking in client.mk;
/cvsroot/mozilla/client.mk,v  <--  client.mk
new revision: 1.385; previous revision: 1.384
done