1647505 - Perma ERROR: Can't find 'AddTrust External Root' in certNameToSKD

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Cristian Brindusan [:cbrindusan]]

#[markdown(off)]
Filed by: cbrindusan [at] mozilla.com

https://treeherder.mozilla.org/logviewer.html#?job_id=307075128&repo=mozilla-central

https://firefox-ci-tc.services.mozilla.com/tasks/T-PCggkCSZ-Lurl8K5jo5A/runs/1/logs/https%3A%2F%2Ffirefox-ci-tc.services.mozilla.com%2Fapi%2Fqueue%2Fv1%2Ftask%2FT-PCggkCSZ-Lurl8K5jo5A%2Fruns%2F1%2Fartifacts%2Fpublic%2Flogs%2Flive.log#L69719

INFO: Generating new HPKP preload list...
+ cd /home/worker/firefox
+ LD_LIBRARY_PATH=:.
+ ./xpcshell /home/worker/scripts/genHPKPStaticPins.js /home/worker/data/PreloadedHPKPins.json /home/worker/data/StaticHPKPins.h.out
JavaScript error: /home/worker/scripts/genHPKPStaticPins.js, line 476: Error: ERROR: Can't find 'AddTrust External Root' in certNameToSKD
+ echo 'INFO: Checking whether new HPKP preload list is valid...'
INFO: Checking whether new HPKP preload list is valid...
+ '[' '!' -s /home/worker/data/StaticHPKPins.h.out ']'
+ grep kPreloadPKPinsExpirationTime /home/worker/data/StaticHPKPins.h.out
+ echo '/home/worker/data/StaticHPKPins.h.out is missing an expiration time. Truncated?'
/home/worker/data/StaticHPKPins.h.out is missing an expiration time. Truncated?
+ exit 53
[taskcluster 2020-06-22 18:03:59.860Z] === Task Finished ===
[taskcluster 2020-06-22 18:03:59.932Z] Artifact "public/build/StaticHPKPins.h.diff" not found at "/home/worker/artifacts/StaticHPKPins.h.diff"
[taskcluster 2020-06-22 18:04:00.008Z] Artifact "public/build/remote-settings.diff" not found at "/home/worker/artifacts/remote-settings.diff"
[taskcluster 2020-06-22 18:04:00.271Z] Unsuccessful task run with exit code: 53 completed in 14503.586 seconds

Comment 1

[Intermittent Failures Robot]

2 failures in 5252 pushes (0.0 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 2

Platform breakdown:

• linux64: 2

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1647505&startday=2020-06-22&endday=2020-06-28&tree=all

Comment 2

[Noemi Erli[:noemi_erli]]

This is a perma fail since Bug 1646763 landed on central:
https://treeherder.mozilla.org/#/jobs?repo=mozilla-central&group_state=expanded&resultStatus=pending%2Crunning%2Csuccess%2Ctestfailed%2Cbusted%2Cexception&searchStr=linux%2Cx64%2Copt%2Crepo-update-hsts-hpkp-blocklist%2C%28pfu%29&selectedTaskRun=b6PfhJSESBiS_xXnZvkuaA.0&tochange=24787602a9f6bc95a34930d3bc087d4ac54fe1a5&fromchange=cbec1e2c0426c8ab7440fe0931d24c25ceef5ed0
Julien, could you please take a look at this?

Comment 3

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

We need to update the Google roots list in security/manager/tools/PreloadedHPKPins.json.

Comment 4

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: Bug 1647505 - update the list of Google roots in PreloadedHPKPins.json DONTBUILD NPOTB r?jcj!,kjacobs!

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b7322e66d779
update the list of Google roots in PreloadedHPKPins.json DONTBUILD NPOTB r=jcj,kjacobs

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/a5d039fe1721

Comment 7

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/b7322e66d779

Comment 8

[Intermittent Failures Robot]

3 failures in 4516 pushes (0.001 failures/push) were associated with this bug in the last 7 days.

Repository breakdown:

• mozilla-central: 3

Platform breakdown:

• linux64: 3

For more details, see:
https://treeherder.mozilla.org/intermittent-failures.html#/bugdetails?bug=1647505&startday=2020-06-29&endday=2020-07-05&tree=all