1380941 - July 2017 batch of root CA changes

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task)

Description

[Kai Engert (:KaiE:)]

July 2017 batch of root CA changes

See dependency list for included changes.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: 1380941-v1.patch

After applying 1380941-v1.patch, certdata.txt no longer contains any lines like
  CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR

The only lines starting with CKA_TRUST_CODE_SIGNING, and the number of occurrences, are:

$ grep ^CKA_TRUST_CODE_SIGNING lib/ckfw/builtins/certdata.txt  | sort | uniq -c
    159 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
     28 CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_NOT_TRUSTED

The patch is big because I've included 50 context lines, to make it easier to see to which root CA the trust changes are related to.

Comment 2

[Kai Engert (:KaiE:)]

test build started:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=33ff6eaa05457339ef6219d0c7de73617f501b1b

Once completed, builds will be available at:
https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-33ff6eaa05457339ef6219d0c7de73617f501b1b/

Comment 3

[Kathleen Wilson]

(In reply to Kai Engert (:kaie:) from comment #2)
> test build started:
> https://treeherder.mozilla.org/#/
> jobs?repo=try&revision=33ff6eaa05457339ef6219d0c7de73617f501b1b
> 
> Once completed, builds will be available at:
> https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-
> 33ff6eaa05457339ef6219d0c7de73617f501b1b/

I only see try-win32 and try-win64. (which I don't have)

Would you please create a try build for MacOS? 

PS: I reviewed the diff of the patch, and it looks correct. So, now I just need to test.

Comment 4

[Kai Engert (:KaiE:)]

(In reply to Kathleen Wilson from comment #3)
> Would you please create a try build for MacOS? 

Thanks to RyanVM who explained to me that things have changed a bit.

In order to find the binary, it's necessary to use the treeherder link from command 2.

Find the line with OSX that contains tc(B). Click the green B inside that tc(B), and the bottom part of the page will change to show more details of that build.

In the right hand colum, you see several "artifact uploaded" entries.

Scroll down that list to find "target.dmg". That's the Mac disk image that you're looking for. Does that work?

Comment 5

[Kai Engert (:KaiE:)]

(In reply to Kai Engert (:kaie:) from comment #4)
> In order to find the binary, it's necessary to use the treeherder link from
> command 2.

from "comment 2".

Comment 6

[Kathleen Wilson]

That worked.  I have tested, and confirmed the changes.

Comment 7

[Kai Engert (:KaiE:)]

https://hg.mozilla.org/projects/nss/rev/f212be04f3d0