1224467 - Add a preference to select OneCRL update mechanism

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Mark Goodwin [:mgoodwin]]

Currently, OneCRL makes use of the AMO blocklist mechanism. This will soon change. We need a way to make this change turn-off-and-on-able

Comment 1

[Mark Goodwin [:mgoodwin]]

Attachment: MozReview Request: Bug1224467 - Add a preference for controlling whether oneCRL blocklists are

Bug1224467 - Add a preference for controlling whether oneCRL blocklists are
updated via AMO. Also add a test. r?keeler,mossop

Comment 2

[Mark Goodwin [:mgoodwin]]

Needless to say, mossop, you don't need to look at the /security/manager bits if you don't want to; keeler can cover those.

Comment 3

[Dana Keeler (she/her) [:keeler]]

Comment on attachment 8687130 [details]
MozReview Request: Bug1224467 - Add a preference for controlling whether oneCRL blocklists are

https://reviewboard.mozilla.org/r/25113/#review22701

LGTM.

::: security/manager/ssl/tests/unit/test_cert_blocklist.js:134
(Diff revision 1)
> -    response.write(blocklist_contents);
> +  dump("Serving for path "+request.path+"\n");

I think do_print is preferred over dump in xpcshell tests. Also, spaces before/after '+'.

::: security/manager/ssl/tests/unit/test_cert_blocklist.js:192
(Diff revision 1)
> +    let certblockObserver = {

nit: two spaces for the initial indentation in this function

::: security/manager/ssl/tests/unit/test_cert_blocklist.js:353
(Diff revision 1)
> +    Services.prefs.setBoolPref("security.onecrl.via.amo", false);

Might be good to test the temporary "not using amo means the blocklist is never fresh" functionality.

::: security/manager/ssl/tests/unit/test_cert_blocklist.js:363
(Diff revision 1)
>    // we need to start the async portions of the test

nit: update/remove comment

Comment 4

[Dave Townsend [:mossop]]

Comment on attachment 8687130 [details]
MozReview Request: Bug1224467 - Add a preference for controlling whether oneCRL blocklists are

https://reviewboard.mozilla.org/r/25113/#review22855

Looks ok. The preference name sounds a bit wierd but since I haven't managed to think of anything better I guess we just go with it.

Comment 5

[Mark Goodwin [:mgoodwin]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=ef43ceee921a

Comment 6

[Mark Goodwin [:mgoodwin]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/9207e17e5e38be9bdadaeb4eb016a599f61dca30
Bug 1224467 - Add a preference for controlling whether oneCRL blocklists are updated via AMO. Also add a test. r=keeler,mossop

Comment 7

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9207e17e5e38