1194013 - convert test_name_constraints.js to generate certificates at build time

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

See bug 1174288. test_name_constraints.js should generate certificates at build time.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: MozReview Request: bug 1194013 - convert test_name_constraints.js to generate certificates at build time

bug 1194013 - convert test_name_constraints.js to generate certificates at build time

Comment 2

[Mark Goodwin [:mgoodwin]]

Comment on attachment 8650021 [details]
MozReview Request: bug 1194013 - convert test_name_constraints.js to generate certificates at build time

https://reviewboard.mozilla.org/r/15933/#review15005

Looks good to me.

Comment 3

[:Cykesiopka]

Comment on attachment 8650021 [details]
MozReview Request: bug 1194013 - convert test_name_constraints.js to generate certificates at build time

https://reviewboard.mozilla.org/r/15933/#review15033

I only glanced over the various .certspec files (I think my eyes would bleed otherwise).

::: security/manager/ssl/tests/unit/moz.build:19
(Diff revision 1)
>      'test_pinning_dynamic',

Minor nit: Might as well sort this after test_ocsp_url.

::: security/manager/ssl/tests/unit/pycert.py:203
(Diff revision 1)
> +    if string.find('/') < 0:

Nit: Maybe |if '/' not in string|?

::: security/manager/ssl/tests/unit/pycert.py:497
(Diff revision 1)
> +            if name.startswith('/'):

Hmm, doesn't this mean directoryName specifications that explicitly specify their encoding will be treated as dNSNames?

::: security/manager/ssl/tests/unit/test_name_constraints/dcisscopy.pem.certspec:1
(Diff revision 1)
> +issuer:printableString/C=FR/ST=France/L=Paris/O=PM/SGDN/OU=DCSSI/CN=IGC/A/emailAddress=[e-mail]

Optional, maybe a follow up: rename this, since it isn't actually a copy anymore.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler]]

https://reviewboard.mozilla.org/r/15933/#review15033

> Hmm, doesn't this mean directoryName specifications that explicitly specify their encoding will be treated as dNSNames?

Good catch.

> Optional, maybe a follow up: rename this, since it isn't actually a copy anymore.

This was an easy change, so I went ahead and did it.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks for the reviews!
https://treeherder.mozilla.org/#/jobs?repo=try&revision=def8c6c31869

Comment 6

[Pulsebot]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7ca1f23e9685

Comment 7

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/7ca1f23e9685