1648815 - support system addon updates with non-builtin cert

Status: RESOLVED FIXED

(Toolkit :: Add-ons Manager, defect, P2)

Description

[Shane Caraveo (:mixedpuppy)]

Evaluate whether something needs to be done here for builtin cert use and product addon updates.

https://searchfox.org/mozilla-central/rev/8118a1f3390b232e70497770d372de062e44dd5f/toolkit/mozapps/extensions/internal/ProductAddonChecker.jsm#476

https://searchfox.org/mozilla-central/rev/8118a1f3390b232e70497770d372de062e44dd5f/toolkit/modules/GMPInstallManager.jsm#97-115

https://searchfox.org/mozilla-central/rev/8118a1f3390b232e70497770d372de062e44dd5f/toolkit/mozapps/extensions/internal/XPIInstall.jsm#3906

Comment 1

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1648815 Don't require builtin certificates for system addon update checks

Comment 2

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1648815 [beta] fix builtin cert use with ProductAddonChecker

Comment 3

[Shane Caraveo (:mixedpuppy)]

Attachment: Bug 1648815 [uplifts] allow non-builtin certs for system addon updates

Comment 4

[Shane Caraveo (:mixedpuppy)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=24cc19110dddd48067f78a64c42e5faa54f8df1e

Comment 5

[Shane Caraveo (:mixedpuppy)]

https://treeherder.mozilla.org/#/jobs?repo=try&revision=fae522e446b15681f24878c80504e507d8ff6ccd

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/9b327379454a
Don't require builtin certificates for system addon update checks r=rpl,aswan

Comment 7

[Dorel Luca [:dluca]]

https://hg.mozilla.org/mozilla-central/rev/9b327379454a

Comment 8

[Shane Caraveo (:mixedpuppy)]

Comment on attachment 9160531 [details]
Bug 1648815 [uplifts] allow non-builtin certs for system addon updates

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: System addons might not update in environments that use corporate or antivirus certificates
• User impact if declined: addons are not updated.
• Fix Landed on Version: 80
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): This uplift patch is a simplified version of the one landed on 80, which fixed a number of related problems. The simplified patch will catch the bulk of all cases but may still suffer the edge cases addressed in the larger patch on 80.
• String or UUID changes made by this patch: none

Beta/Release Uplift Approval Request

• User impact if declined: System addons might not update in environments that use corporate or antivirus certificates
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: No
• Needs manual test from QE?: No
• If yes, steps to reproduce:
• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): It only allows the use of non-builtin certs for updates to system addons.
• String changes made/needed: none

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9160531 [details]
Bug 1648815 [uplifts] allow non-builtin certs for system addon updates

Improves our ability to update system addons in locked-down environments. Approved for 79.0b8 and 78.1esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/eef88efebbb2

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr78/rev/4efd5bf491c5