1545836 - Require COSE signatures for extensions

Status: RESOLVED WONTFIX

(Core :: Security: PSM, enhancement, P2)

Description

[Daniel Veditz [:dveditz]]

Currently the value of "security.signed_app_signatures.policy" is "2", which will verify COSE extensions if present but accepts weak SHA-1 file hashes for PKCS#7 signatures.

We've had a long transition period and would like to now require the use of COSE signatures by changing the value of that pref to "4".

Comment 1

[:shell escalante]

We're still confirming (though sounds very close) - that this should not land until Firefox 70. Will update bug title to include that to avoid landing in an earlier version of Firefox.

Comment 2

[Jim Mathies [:jimm]]

(In reply to :shell escalante from comment #1)

We're still confirming (though sounds very close) - that this should not land until Firefox 70. Will update bug title to include that to avoid landing in an earlier version of Firefox.

I'm currently asking around to try and figure out where we are on this. Requiring COSE will not ship in 70. Good to get the validation out in 69 for testing.

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

This has been on hold for a while, so I'm going to wontfix this for now.