1332131 - many psm xpcshell test certificates are expiring soon (e.g. in February)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Dana Keeler (she/her) (use needinfo) [:keeler]]

In bug 1256495 we "temporarily" checked the generated psm xpcshell test certificates into the tree. Many of these certificates expire on 4 February 2017, which is coming up soon. We'll probably need to re-generate them and check them in again.

Comment 1

[Masatoshi Kimura [:emk]]

Do we have a bug that tracks a permanent (just-in-time) solution?

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Maybe bug 1198077?

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Attachment: bug 1332131 - regenerate psm xpcshell test certificates to avoid failures when they expire

Review commit: https://reviewboard.mozilla.org/r/105918/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/105918/

Comment 4

[:Cykesiopka]

Comment on attachment 8828591 [details]
bug 1332131 - regenerate psm xpcshell test certificates to avoid failures when they expire

https://reviewboard.mozilla.org/r/105918/#review107074

LGTM, although I only checked a few certs to confirm their notAfter is in 2018.
Other than that, I just ensured that the certs that should've changed did change.

Comment 5

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Thanks!
Try looked good: https://treeherder.mozilla.org/#/jobs?repo=try&revision=71e5963f76e94c890a38c9fbf74ac91379e7af06

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d15f6cbb443d
regenerate psm xpcshell test certificates to avoid failures when they expire r=Cykesiopka

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/d15f6cbb443d

Comment 8

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Hi Wes, sorry to spring this on you, but this issue affects every supported branch, essentially. If I could get some help uplifting this before February, that would be great. Thank you! (Luckily, it's test-only changes, so we shouldn't have to wait for approval.)

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Should this end up on release (in case of chemspill) and esr45, too?

Comment 10

[Dana Keeler (she/her) (use needinfo) [:keeler]]

I imagine so - if the xpcshell test suite is run after 4 February 2017, it will fail without this patch.

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/537e167ee9d2

Comment 12

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

26 of the files touched in the patch pushed to beta don't exist on release, and only the moz.build file exists on esr45 (and it has merge conflicts). Is it okay to push this to release, and can you make a rebased patch for esr45, assuming all of the files were just moved around?

Comment 13

[Dana Keeler (she/her) (use needinfo) [:keeler]]

Oh, sorry - it looks like any branch older than 48 isn't affected (bug 1256495 landed in 48), so esr45 actually doesn't need this.

For mozilla-release, the mochitest certs are from bug 1186286, the bad_certs are from bug 1313491, the test_ev_certs are from bug 1243923, the test_pinning_dynamic certs are from bug 1306471, and test_x509.js is from bug 1304188. All of these landed in 52, so it's consistent that they're not in release/51. In other words, the patch should be fine to land on release without those 26 files. Thanks!

Comment 14

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/releases/mozilla-release/rev/fd175ff6d784a34352efba79f031949473c7d734

Comment 15

[:Gijs (he/him)]

So, the way this stuff works right now also means that if you run a trypush and it's on a parent that predates the cert change, tests fail with incomprehensible error messages and you get confused (whereas if you rebase the patch to a parent that doesn't predate the cert change, tests will pass). Can't the test framework generate its own certs so we avoid this issue in the future?

Comment 16

[Dana Keeler (she/her) (use needinfo) [:keeler]]

That's the way this worked before bug 1256495, but we got complaints that it took too much build time. The right thing to do would be to teach the build/test infrastructure to generate these files as-needed (so if you're not running these tests it won't affect you), but no one has done that work (see also bug 1198077).