1247990 - February 2016 batch of root CA changes

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Kai Engert [:KaiE:]]

February 2016 batch of root CA changes

Comment 1

[Kai Engert [:KaiE:]]

Attachment: patch v1

Comment 2

[Kai Engert [:KaiE:]]

Attachment: patch v2

include the version number change

Comment 3

[Kai Engert [:KaiE:]]

A test build with patch v2 has been started:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=07071a9ff90a

Once completed, builds and logs will be available at:
https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-07071a9ff90abbdd2080e579bc84c9fde0811e68/

Comment 4

[Kai Engert [:KaiE:]]

Attachment: patch v3

Patch v2 had incorrectly enabled the code signing bit for SZAFIR.

This patch v3 keeps the SZAFIR code signing bit in the neutral state, as requested.

Comment 5

[Kai Engert [:KaiE:]]

A test build with patch v3 has been started:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=56e4bdcc6131

Once completed, builds and logs will be available at:
https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-56e4bdcc61313a06c12645a74e39b57092bb6977/

Comment 6

[Kai Engert [:KaiE:]]

Attachment: Patch v4

I fixed another mistake. I had used the wrong friendly name.

Comment 7

[Kai Engert [:KaiE:]]

A test build with patch v4 has been started:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=4897de4acb25

Once completed, builds and logs will be available at:
https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-4897de4acb25ddb71d521adb05b86667c000aed7/

Comment 8

[Kathleen Wilson]

(In reply to Kai Engert (:kaie) from comment #7)
> A test build with patch v4 has been started:
> https://treeherder.mozilla.org/#/jobs?repo=try&revision=4897de4acb25
> 
> Once completed, builds and logs will be available at:
> https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-
> 4897de4acb25ddb71d521adb05b86667c000aed7/

I reviewed the patch, and all the changes are as requested.

I tested the Mac build, and verified all the changes.

I will ask the applicable CAs to test too.

Thanks!

Comment 9

[Matt Wobensmith [:mwobensmith][:matt:]]

I ran a canary pass, and found no breakage.

Comment 10

[Kathleen Wilson]

(In reply to Kathleen Wilson from comment #8)
> I will ask the applicable CAs to test too.

Applicable CA testing has been successfully completed.

Please continue with this patch.

Thanks!

Comment 11

[Kai Engert [:KaiE:]]

Bob, could you please review this watch? It's a blocker, because this is the last thing that need to go into the NSS 3.23 and 3.22.2 releases. Thanks.

Comment 12

[Kai Engert [:KaiE:]]

s/watch/patch/

Comment 13

[Richard Barnes [:rbarnes]]

Comment on attachment 8719920 [details] [diff] [review]
Patch v4

Review of attachment 8719920 [details] [diff] [review]:
-----------------------------------------------------------------

I verified:
* The added roots parse correctly
* The added and removed roots match the corresponding bugs

Comment 14

[Kai Engert [:KaiE:]]

Checked in to NSS trunk:
https://hg.mozilla.org/projects/nss/rev/612cfac63edf

Checked in to NSS 3.22.x branch for NSS 3.22.2
https://hg.mozilla.org/projects/nss/rev/31d81bbebd3c