1317947 - Upgrade Firefox 53 to NSS 3.29

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Franziskus Kiefer [:franziskus]]

Tracking NSS 3.29 for Firefox 53.

Comment 1

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f296d0342384
land NSS 0x5b7a40ced8c5, r=me

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/f296d0342384

Comment 3

[Franziskus Kiefer [:franziskus]]

forgot to set leave-open. there will be more landings

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c9bbbf248796
land NSS 0x8219c4fd5c47, r=me

Comment 5

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c9bbbf248796

Comment 6

[areya]

https://hg.mozilla.org/mozilla-central/rev/c9bbbf248796

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/10daeea4d322
land NSS 0x86638bd12ab0, r=me

Comment 8

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/10daeea4d322

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/ecb49ac10357
land NSS 0x6c26f0cd19ba, r=me

Comment 10

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/ecb49ac10357

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/32517c1a54e9
land NSS 0x0ce009e2303a, r=me

Comment 12

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/32517c1a54e9

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/e777cf9e040f
land NSS 0x5f2db99c258f, r=me

Comment 14

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/e777cf9e040f

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/fb400cfedafa
land NSS 0x5e59e858012d, r=me

Comment 16

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/fb400cfedafa

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/cc64be07afe2
land NSS 0x6353ce63e18f, r=me

Comment 18

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/cc64be07afe2

Comment 19

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/f037753a1db2
bump NSS version in old-configure, r=me

Comment 20

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/f037753a1db2

Comment 21

[Carsten Book [:Tomcat]]

Attachment: mozilla-test-fail-screenshot_8OwCIR.png

backed out for causing timeouts in dt tests like https://treeherder.mozilla.org/logviewer.html#?job_id=70274867&repo=mozilla-inbound

however the real issue might be the error message in the attachment, this might be explain why a nss change breaks devtools tests

Comment 22

[Carsten Book [:Tomcat]]

also https://treeherder.mozilla.org/logviewer.html#?job_id=70274621&repo=mozilla-inbound seems to be realted to this changes here

Comment 23

[Dana Keeler (she/her) (use needinfo) (:keeler for reviews)]

[task 2017-01-19T08:54:09.131407Z] 08:54:09     INFO -  "handling good.include-subdomains.pinning.example.com"
[task 2017-01-19T08:54:09.131705Z] 08:54:09  WARNING -  TEST-UNEXPECTED-FAIL | security/manager/ssl/tests/unit/test_cert_chains.js |  - Actual and expected connection result should match - 2153394174 == 0
[task 2017-01-19T08:54:09.131988Z] 08:54:09     INFO -  /storage/sdcard/tests/xpc/security/manager/ssl/tests/unit/head_psm.js:add_connection_test/</<:454

2153394174 is SSL_ERROR_NO_CYPHER_OVERLAP - could it be that the cipher suites that are enabled by default in NSS no longer overlap with what Firefox enables?

Comment 24

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2164277367cc
land NSS ea43fcc316e1, r=me
https://hg.mozilla.org/integration/autoland/rev/3112cbcca0f4
Backed out changeset 2164277367cc for causing timeouts in devtools tests on a CLOSED TREE

Comment 25

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=b2f3cab1adc7

Comment 26

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/052b90b5414f
land NSS ee21c9892907, r=me

Comment 27

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/052b90b5414f

Comment 28

[Franziskus Kiefer [:franziskus]]

Attachment: 329ff53.patch

Final NSS 3.29 release for Firefox 53 that currently holds the latest 3.29 beta.

Comment 29

[Franziskus Kiefer [:franziskus]]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=e5dec31c5b82

Comment 30

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Comment on attachment 8833910 [details] [diff] [review]
329ff53.patch

Let's get the final/release version of NSS 3.29 to replace the beta version, onto aurora.

Comment 31

[Liz Henry (:lizzard Please n-i to RyanVM, jcristau, or pascal)]

Tweaking the flag so this will show in queries. 
Franziskus, do you want to land this on aurora yourself or would you like someone else to do it?

Comment 32

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9ad41a8fca06