1341396 - Generate transparency metadata for Firefox releases

Status: RESOLVED INCOMPLETE

(Firefox :: Security, defect, P3)

Description

[Richard Barnes [:rbarnes]]

Including:

* Merkle tree head for a release (over SHA256SUMS)
* Inclusion proofs to that tree head for each file in the release
* Certificate covering that tree head
* Proof of log inclusion (Signed Certificate Timestamp or inclusion proof)

Comment 1

[Richard Barnes [:rbarnes]]

Attachment: Sample SHA256SUMMARY file

Produced by release automation for 53.0b2.  Not present in the release because of a failure to upload; recovered from logs instead.

Comment 2

[Richard Barnes [:rbarnes]]

Attachment: Sample transparency certificate chain

Generated by Let's Encrypt, via a draft script to create certificates from SHA256SUMMARY files.

Comment 3

[Richard Barnes [:rbarnes]]

Attachment: Sample transparency certificate chain

Generated by Let's Encrypt via a draft script for creating certificates from summary files.

Comment 4

[Richard Barnes [:rbarnes]]

Attachment: Sample transparency SCT

Generated by the Google Pilot log, via a draft script to submit transparency certs to logs and get SCTs.

Comment 5

[Richard Barnes [:rbarnes]]

With the three attachments I just posted, you should be able to verify that binaries in the 53.0b2 release have been publicly committed:

- Verify the inclusion proof for the file with the indicated tree head
- Verify that the tree head is in the certificate
- Verify that the SCT covers the certificate

Comment 6

[Jordan Lund (:jlund)]

Brandon Tang is going to start looking into this for us! :D

Comment 7

[Nick Thomas [:nthomas] (UTC+12)]

And now it passes to me. In addition to the steps in comment #0 we need to submit data into the update server.

Comment 8

[Julien Cristau [:jcristau]]

As far as I can tell this effort died down some years ago; closing.