1216577 - HSTS/HPKP updates not running on b2g37

Status: RESOLVED WONTFIX

(Release Engineering :: General, defect)

Description

[Carsten Book [:Tomcat]]

seems they should but they are not running and so causing testfailures on b2g37

Callek, keeler, do you know who could look into this ?

Comment 1

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Keeler, is there any way to manually get these updated once without getting the automation set up in here? Could I just steal the files from esr38, for instance?

Comment 2

[Dana Keeler (she/her) [:keeler]]

My guess as to what's going on is b2g37 can't find a root certificate it thinks it needs for a pinset, so the update script fails. I don't know where the logs from the failed updates are, though, so I can't confirm. Copying the StaticHPKPins.h file from esr38 would add some new sites and update the expiration time, so the tests would probably pass, but future updates would still fail. It's probably safe to do as a stop-gap, though.

Comment 3

[Phil Ringnalda (:philor)]

http://ftp-origin-scl3.mozilla.org/pub/mozilla.org/firefox/tinderbox-builds/mozilla-b2g37_v2_2-linux64/mozilla-b2g37_v2_2-linux64-periodicupdate-bm73-build1-build0.txt.gz and thus bug 1211770.

Comment 4

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Landed https://hg.mozilla.org/releases/mozilla-b2g37_v2_2/rev/9e0aa88fea7a to see if that fixes the xpcshell failures, at least temporarily.

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/releases/mozilla-b2g37_v2_2r/rev/9e0aa88fea7a