902761 - Stop storing certs used for MAR verification in EXE resource files

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect)

Description

[Brian R. Bondy [:bbondy]]

In preparation for verifying MARs on all platforms, we should have a platform independent way to store the certificates used in MAR verification.
On Windows we currently stash them in the exe's resource section.

The idea is to instead create a python scrip that will run when building to generate a .h file.  The .h file will contain an array of hex char numbers. The array will hold the byte of the .der file.  It will simply be included into updater.cpp/archivereader.cpp and used directly.

This bug is only for making the cert loading platform independent.
Other bugs will be posted later for doing the rest of the work to get OSX and Linux verifying mar files.

Comment 1

[Brian R. Bondy [:bbondy]]

Attachment: WIP python script to generate header file

Comment 2

[Brian R. Bondy [:bbondy]]

Attachment: Build config for turning DER files into .h files - rev1

Will be pushing to oak for testing, didn't test yet.

Comment 3

[Brian R. Bondy [:bbondy]]

Attachment: Load cert data directly from .h files - rev1

Comment 4

[Brian R. Bondy [:bbondy]]

Attachment: Load cert data directly from .h files - rev2

Fix cert verification error

Comment 5

[Brian R. Bondy [:bbondy]]

rstrong this is all green and tested now, and should be ready to go:
https://tbpl.mozilla.org/?tree=Try&rev=ae3c132f37dd

Comment 6

[Robert Strong (they/them - no direct email)]

Comment on attachment 787759 [details] [diff] [review]
Build config for turning DER files into .h files - rev1

For the ifneq you can use the following format
http://mxr.mozilla.org/mozilla-central/source/layout/build/Makefile.in#78

Please convert to unix newlines

Comment 7

[Brian R. Bondy [:bbondy]]

(In reply to Robert Strong [:rstrong] (do not email) from comment #6)
> Comment on attachment 787759 [details] [diff] [review]
> Build config for turning DER files into .h files - rev1
> 
> For the ifneq you can use the following format
> http://mxr.mozilla.org/mozilla-central/source/layout/build/Makefile.in#78
> 
> Please convert to unix newlines

It is already unix newlines

Comment 8

[Brian R. Bondy [:bbondy]]

(In reply to Brian R. Bondy [:bbondy] from comment #7)
> (In reply to Robert Strong [:rstrong] (do not email) from comment #6)
> > Comment on attachment 787759 [details] [diff] [review]
> > Build config for turning DER files into .h files - rev1
> > 
> > For the ifneq you can use the following format
> > http://mxr.mozilla.org/mozilla-central/source/layout/build/Makefile.in#78

The only difference I could see here was the else and ifneq on different lines. So uploading that change in a new patch. Let me know if I missed anything else.

Comment 9

[Brian R. Bondy [:bbondy]]

Attachment: Build config for turning DER files into .h files - rev2

Implemented nit. Carrying forward r+.

Comment 10

[Brian R. Bondy [:bbondy]]

Attachment: Build config for turning DER files into .h files - rev3

Didn't realize combining the else and ifneq on the same line would reduce the need for the exra endif. Fixed.

Comment 11

[Brian R. Bondy [:bbondy]]

Attachment: Build config for turning DER files into .h files - rev3'

qref'ed :)

Comment 12

[Robert Strong (they/them - no direct email)]

(In reply to Brian R. Bondy [:bbondy] from comment #7)
> (In reply to Robert Strong [:rstrong] (do not email) from comment #6)
> > Comment on attachment 787759 [details] [diff] [review]
> > Build config for turning DER files into .h files - rev1
> > 
> > For the ifneq you can use the following format
> > http://mxr.mozilla.org/mozilla-central/source/layout/build/Makefile.in#78
> > 
> > Please convert to unix newlines
> 
> It is already unix newlines
When I imported the patch a second time gen_cert_header.py it was created again with CRLF newlines

Comment 13

[Brian R. Bondy [:bbondy]]

(In reply to Robert Strong [:rstrong] (do not email) from comment #12)
> (In reply to Brian R. Bondy [:bbondy] from comment #7)
> > (In reply to Robert Strong [:rstrong] (do not email) from comment #6)
> > > Comment on attachment 787759 [details] [diff] [review]
> > > Build config for turning DER files into .h files - rev1
> > > 
> > > For the ifneq you can use the following format
> > > http://mxr.mozilla.org/mozilla-central/source/layout/build/Makefile.in#78
> > > 
> > > Please convert to unix newlines
> > 
> > It is already unix newlines
> When I imported the patch a second time gen_cert_header.py it was created
> again with CRLF newlines


Ah sorry, the comment appeared just under Makefile.in so I thought you were talking about that file. Should have checked both.  New patch coming.

Comment 14

[Brian R. Bondy [:bbondy]]

Attachment: Build config for turning DER files into .h files - rev4

Stripped \r from the python file. Carrying forward r+.

Comment 15

[Stephen A Pohl [:spohl]]

Attachment: Part 1: Build config for turning DER files into .h files - rev4

Updated for current trunk. Carrying over r+.

Comment 16

[Stephen A Pohl [:spohl]]

Attachment: Part 2: Load cert data directly from .h files - rev2

Updated for current trunk. Carrying over r+.

Comment 17

[Brian R. Bondy [:bbondy]]

Attachment: Part 1: Build config for turning DER files into .h files - rev5

Rebase to m-c tip and add nightly-ux (it was missed before)

Comment 18

[Brian R. Bondy [:bbondy]]

Tested this with a corrected manifest and we're all good.

https://hg.mozilla.org/integration/mozilla-inbound/rev/c249afdad744
https://hg.mozilla.org/integration/mozilla-inbound/rev/149fc4026b50

Comment 19

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/c249afdad744
https://hg.mozilla.org/mozilla-central/rev/149fc4026b50

Comment 20

[Mike Hommey [:glandium]]

Comment on attachment 8505915 [details] [diff] [review]
Part 1: Build config for turning DER files into .h files - rev5

Review of attachment 8505915 [details] [diff] [review]:
-----------------------------------------------------------------

::: toolkit/mozapps/update/updater/Makefile.in
@@ +35,5 @@
> +
> +export::
> +	$(PYTHON) $(srcdir)/gen_cert_header.py primaryCertData $(srcdir)/$(PRIMARY_CERT) > primaryCert.h
> +	$(PYTHON) $(srcdir)/gen_cert_header.py secondaryCertData $(srcdir)/$(SECONDARY_CERT) > secondaryCert.h
> +	$(PYTHON) $(srcdir)/gen_cert_header.py xpcshellCertData $(srcdir)/xpcshellCertificate.der > xpcshellCert.h

This should have been reviewed by a build peer.