1375900 - NSS taskcluster tests should run PKITS tests

Status: NEW

(NSS :: Test, enhancement, P3)

Description

[Kai Engert [:KaiE:]]

The NSS taskcluster test environment should execute the pkits.sh test.

In order to run successfully, it's necessary to install the contents of the PKITS_data.zip file and to set the PKITS_DATA environment variable to the directory that contains the extracted archive.

Comment 1

[Kai Engert [:KaiE:]]

See https://wiki.mozilla.org/NSS:LinuxTinderbox
for some old instructions that mention PKITS, and which has a link to a cached copy of the required archive.

There appears to be a newer version of that archive available at
  http://csrc.nist.gov/groups/ST/crypto_apps_infra/documents/PKITS_data.zip
  http://csrc.nist.gov/groups/ST/crypto_apps_infra/pki/pkitesting.html

Comment 2

[Franziskus Kiefer [:franziskus]]

Not sure if this is worth doing with the PKI engines currently in NSS.

Comment 3

[Kai Engert [:KaiE:]]

(In reply to Franziskus Kiefer [:fkiefer or :franziskus] from comment #2)
> Not sure if this is worth doing with the PKI engines currently in NSS.

Why?

They are used by apps that don't use mozilla::pkix. They seem to contain testing for name constraints, and I think currently we don't have other tests covering them.

Comment 4

[Emma Humphries ☕️🎸🧞‍♀️✨ (she/they) [:emceeaich] (Pacific Time) use needinfo]

Bulk change per wleung.