1182352 - Remove custom cert check code from app update

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect)

Description

[Robert Strong (they/them - no direct email)]

After mar signing is used on Linux (it already is on Mac and Windows) the cert checks can be disabled in bug 1151485. After that has baked for a short while the custom cert checking code can be removed from app update.

Comment 1

[Robert Strong (they/them - no direct email)]

The Firefox preferences should also be cleaned up in this bug

Comment 2

[Robert Strong (they/them - no direct email)]

Filed bug 1189843 and bug 1189845 for Thunderbird and SeaMonkey to remove the cert checks. This bug doesn't depend on those bugs being fixed since app update will still work for those apps when this code is removed though it will remove the security mitigation.

Comment 3

[Robert Strong (they/them - no direct email)]

If for whatever reason mar signing is not implemented then real cert pinning should be implemented. We didn't do this for Firefox aus since it has the same problems as the custom cert check. See bug bug 1063111

Comment 4

[Robert Strong (they/them - no direct email)]

Attachment: nsISecurityUITelemetry changes

Comment 5

[Robert Strong (they/them - no direct email)]

Attachment: client changes in progress

Comment 6

[Robert Strong (they/them - no direct email)]

Attachment: client changes rev1

Comment 7

[Robert Strong (they/them - no direct email)]

Attachment: test changes rev1

Pushed to try
https://treeherder.mozilla.org/#/jobs?repo=try&revision=1386b4a18f94

Comment 8

[Robert Strong (they/them - no direct email)]

Comment on attachment 8780467 [details] [diff] [review]
nsISecurityUITelemetry changes

Hi Dan, as you might recall we no longer use the custom certificate attribute check code since it causes issues with some use cases and rely on mar signing instead. The patches in this bug remove the checks and there is one change in nsISecurityUITelemetry.idl that I am hoping you are ok with reviewing. Thanks!

Comment 9

[Robert Strong (they/them - no direct email)]

Comment on attachment 8781905 [details] [diff] [review]
test changes rev1

Try push
https://treeherder.mozilla.org/#/jobs?repo=try&revision=1386b4a18f94&selectedJob=25870034

Comment 10

[Molly Howell (she/her) (mostly inactive)]

Comment on attachment 8781905 [details] [diff] [review]
test changes rev1

Review of attachment 8781905 [details] [diff] [review]:
-----------------------------------------------------------------

Everything looks good and the try push is green, so I'm happy. Thanks!

Comment 11

[Robert Strong (they/them - no direct email)]

Bug 1295896 removes several tests that would also need to be modified so adding dependency.

Comment 12

[Robert Strong (they/them - no direct email)]

Attachment: test changes rev2

Forgot to hg remove a couple of tests. Carrying forward r+

Comment 13

[Robert Strong (they/them - no direct email)]

Attachment: Firefox preference

Matt, forgot to remove this no longer available preference from firefox.js

Comment 14

[Molly Howell (she/her) (mostly inactive)]

Comment on attachment 8782172 [details] [diff] [review]
Firefox preference

Review of attachment 8782172 [details] [diff] [review]:
-----------------------------------------------------------------

No problem; I saw your comment saying this needed to be removed, and then I also forgot about it.

Comment 15

[Daniel Veditz [:dveditz]]

Comment on attachment 8780467 [details] [diff] [review]
nsISecurityUITelemetry changes

Review of attachment 8780467 [details] [diff] [review]:
-----------------------------------------------------------------

r=dveditz

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/4bd0ad73562b
nsISecurityUITelemetry.idl - Remove custom cert check code from app update. r=dveditz
https://hg.mozilla.org/integration/mozilla-inbound/rev/1bf5bb2dc20d
client code - Remove custom cert check code from app update. r=mhowell
https://hg.mozilla.org/integration/mozilla-inbound/rev/4b648a542bfb
test code - Remove custom cert check code from app update. r=mhowell
https://hg.mozilla.org/integration/mozilla-inbound/rev/b717faf86fe7
Firefox preference removal - Remove custom cert check code from app update. r=mhowell

Comment 17

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/4bd0ad73562b
https://hg.mozilla.org/mozilla-central/rev/1bf5bb2dc20d
https://hg.mozilla.org/mozilla-central/rev/4b648a542bfb
https://hg.mozilla.org/mozilla-central/rev/b717faf86fe7