1439378 - Re-enable browser_console_certificate_imminent_distrust.js

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[J.C. Jones [:jcj] (he/him)]

Bug 1434300 disables browser_console_certificate_imminent_distrust.js due to a lack of time on updating that test. (It just needs the time to figure out what to do with the new NSS database format update in-tree.)

This bug is to fix and re-enable that test.

Comment 1

[J.C. Jones [:jcj] (he/him)]

Attachment: Bug 1439378 - Re-enable the imminent distrust browser-console test

This patch does a few things:
1) It removes the symantecRoot and symantec_affected certs from build/pgo/certs'
   DB.
2) It upgrades that DB from the old format to SQLite (and this 8/3 to 9/4).
3) It adds a new cert "imminently_distrusted" to that DB for the bc test.
4) It changes the Subject of the immient distrust test to only have the CN
   field: this is because certutil reorders C to come after CN, and just like
   with the real Symantec certs, I had put C first. So rather than deal with
   importing the end entity for the pgo tests, I decided to just make things
   simple and change the tested subject.
5) Finally, it re-enables the test that was disabled in Bug 1434300.

Review commit: https://reviewboard.mozilla.org/r/222352/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/222352/

Comment 2

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Comment on attachment 8953077 [details]
Bug 1439378 - Re-enable the imminent distrust browser-console test

https://reviewboard.mozilla.org/r/222352/#review228356

LGTM with documentation update (and maybe poke around in genpgocert.py to make sure it still works as well as it's supposed to (and it's unclear exactly how well it's supposed to work...))

::: commit-message-ea3da:6
(Diff revision 1)
> +Bug 1439378 - Re-enable the imminent distrust browser-console test r?keeler r?fkiefer
> +
> +This patch does a few things:
> +1) It removes the symantecRoot and symantec_affected certs from build/pgo/certs'
> +   DB.
> +2) It upgrades that DB from the old format to SQLite (and this 8/3 to 9/4).

Looks like at least the documentation at https://hg.mozilla.org/mozilla-central/annotate/42e118e10c22/build/pgo/certs/README#l9 should be updated. Does build/pgo/genpgocert.py still work with these changes? (Did it ever work after we started hand-rolling changes to the certificates in the database?)

Comment 3

[Franziskus Kiefer [:franziskus]]

Comment on attachment 8953077 [details]
Bug 1439378 - Re-enable the imminent distrust browser-console test

https://reviewboard.mozilla.org/r/222352/#review228534

Comment 4

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 8953077 [details]
Bug 1439378 - Re-enable the imminent distrust browser-console test

https://reviewboard.mozilla.org/r/222352/#review228356

> Looks like at least the documentation at https://hg.mozilla.org/mozilla-central/annotate/42e118e10c22/build/pgo/certs/README#l9 should be updated. Does build/pgo/genpgocert.py still work with these changes? (Did it ever work after we started hand-rolling changes to the certificates in the database?)

Filed bug 1441338.

Comment 5

[J.C. Jones [:jcj] (he/him)]

Comment on attachment 8953077 [details]
Bug 1439378 - Re-enable the imminent distrust browser-console test

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/222352/diff/1-2/

Comment 6

[J.C. Jones [:jcj] (he/him)]

Try run is clean: https://treeherder.mozilla.org/#/jobs?repo=try&revision=ea3bfc36ea5104fdb8e0dc1ab835f31ab6307365

Checkin-needed. Thanks!

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8a6479f41ba9
Re-enable the imminent distrust browser-console test r=fkiefer,keeler

Comment 8

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/8a6479f41ba9