1341397 - Distribute binary transparency information with releases

Status: NEW

(Firefox :: Security, defect, P3)

Description

[Richard Barnes [:rbarnes]]

For each release, need to provide:

* Certificate including a Merkle tree head for the release
* Proof that the certificate has been publicly logged (Inclusion proof / SCT)

For each file in the release, need to provide:

* Inclusion proof to the Merkle tree head

Comment 1

[Nick Thomas [:nthomas] (UTC+12)]

Is the intention that these things need to be in the releases directory, like https://archive.mozilla.org/pub/firefox/releases/59.0.1/ ? The inclusion proofs are present in SHA256SUMMARY.

Comment 2

[Tom Ritter [:tjr] (OOTO until 4/30 at least)]

I think it would be great if we could include the x509 cert (the full chain, just one file). That would be really convenient.

But the rest, no we don't need to put those in the release directory. I think the intent for this bug was to document what we needed to include in the update.xml file.