1561967 - Upgrade Firefox 68 to use NSS 3.44.2

Status: RESOLVED INVALID

(Core :: Security: PSM, task)

Description

[J.C. Jones [:jcj] (he/they)]

[Tracking Requested - why for this release]:

This is an update for NSS 3.44 for Firefox 68. It will contain performance improvements on ARM32 platforms:

• Bug 1550579 - Replace arm32 curve25519 ref implementation with fiat-crypto

This is primarily intended to support GeckoView/Fenix.

When ready, the tag will be NSS_3_44_2_RTM.

Comment 1

[Chris Peterson [:cpeterson]]

This change sounds scary. Has NSS_3_44_2_RTM already landed in Fennec and GeckoView Nightly?

We might want to uplift to the Fennec ESR 68 branch, skipping the Fennec 68.0 release. We can let it bake in the Fennec Nightly/Beta channel and then release in Fennec ESR 68.1 (2019-09-03).

Comment 2

[J.C. Jones [:jcj] (he/they)]

I am unfamiliar with how it would go about landing in Fennec or GeckoView nightly without landing in mozilla-beta, but personally I am fine with however the Performance and GeckoView teams would like to proceed.

Randell, Chris, you two are our drivers for this release, so please let me know what to do here.

Comment 3

[Julien Cristau [:jcristau]]

I'm not sold on uplifting this even to 68.1esr to be honest, since fennec is basically on life support and this isn't a regression.

Comment 4

[Randell Jesup [:jesup] (needinfo me)]

Julien - thanks - though that will mean Fennec users will live with the current (bad) performance until sometime in the fall (and that assumes to auto-update people over to Fenix; if we don't then they'll live with it until they manually switch, perhaps on some prompting from us). However, ec25519 is not by any means the most common cipher; AES is, and the AES patches are still being tested I believe - though a similar argument could be made then.

Comment 5

[J.C. Jones [:jcj] (he/they)]

Marking this INVALID. We'll file a different uplift bug for a future patch release.