1280331 - Update HPKP preload script URL to deal with renaming of transport_security_state_static.certs

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[:Cykesiopka]

https://chromium.googlesource.com/chromium/src/net/+/4361f2ad66b6af0a8acfb42f34b95bfbcad3926a renamed transport_security_state_static.certs to transport_security_state_static.pins, meaning the periodic update script is now retrieving a 404 resource:
https://hg.mozilla.org/mozilla-central/annotate/14c5bf11d37b9e92d27f7089d9392de2ac339bb3/security/manager/tools/PreloadedHPKPins.json#l32
> "cert_file_url": "https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.certs?format=TEXT",

The URL should be updated on m-c, m-a and esr45.

Comment 1

[:Cykesiopka]

I can fix this sometime next week, but if someone would like to take this before then, feel free.

Comment 2

[:Cykesiopka]

Attachment: Bug 1280331 - Update HPKP preload script URL to deal with renaming of transport_security_state_static.certs.

https://chromium.googlesource.com/chromium/src/net/+/4361f2ad66b6af0a8acfb42f34b95bfbcad3926a
renamed transport_security_state_static.certs to
transport_security_state_static.pins, so the URL needs to be updated to avoid
a 404.

Review commit: https://reviewboard.mozilla.org/r/60116/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/60116/

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8764071 [details]
Bug 1280331 - Update HPKP preload script URL to deal with renaming of transport_security_state_static.certs.

https://reviewboard.mozilla.org/r/60116/#review57090

Great - thanks.

Comment 4

[:Cykesiopka]

Thanks!

NPOTB, but a try push anyways: https://treeherder.mozilla.org/#/jobs?repo=try&revision=0d5a4e8a1a8b

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e8609677b8b9
Update HPKP preload script URL to deal with renaming of transport_security_state_static.certs. r=keeler

Comment 6

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/e8609677b8b9

Comment 7

[:Cykesiopka]

This change needs to be uplifted to m-a and ESR45 as well. I'm not bothering with an approval request because the change here is NPOTB and carries no risk - the HPKP periodic update process is already broken, and this change can't break things further.

Thanks.

Comment 8

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-aurora/rev/254bebcb7010

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-esr45/rev/11b854c57f10