1771523 - Add Telemetry Probe for the signatures present on addons

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P3)

Description

[Dennis Jackson]

Mozilla has signed addons with both PKCS#7 signatures and COSE signatures since 2019. This probe records the outcome of this verification and which signatures were present. This let us know whether we can deprecate the PKCS#7 signature entirely.

Comment 1

[Dennis Jackson]

Attachment: Bug 1771523 - Add telemetry probe for app signature verification outcomes. r=keeler

Comment 2

[Dennis Jackson]

Attachment: data-review-addon-signature.md

Comment 3

[Chris H-C :chutten]

Comment on attachment 9278795 [details]
data-review-addon-signature.md

DATA COLLECTION REVIEW RESPONSE:

Is there or will there be documentation that describes the schema for the ultimate data set available publicly, complete and accurate?

Yes.

Is there a control mechanism that allows the user to turn the data collection on and off?

Yes. This collection is Telemetry so can be controlled through Firefox's Preferences.

If the request is for permanent data collection, is there someone who will monitor the data over time?

Yes, Dennis Jackson is responsible.

Using the category system of data types on the Mozilla wiki, what collection type of data do the requested measurements fall under?

Category 1, Technical.

Is the data collection request for default-on or default-off?

Default on for all channels.

Does the instrumentation include the addition of any new identifiers?

No.

Is the data collection covered by the existing Firefox privacy notice?

Yes.

Does the data collection use a third-party collection tool?

No.

---

Result: datareview+

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/d6e40ddd6505
Add telemetry probe for app signature verification outcomes. r=keeler

Comment 5

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/d6e40ddd6505

Comment 6

[Dennis Jackson]

Comment on attachment 9278510 [details]
Bug 1771523 - Add telemetry probe for app signature verification outcomes. r=keeler

ESR Uplift Approval Request

• If this is not a sec:{high,crit} bug, please state case for ESR consideration: This patch adds telemetry which is needed to support decision making about changes to addon signing. It has been approved for release channels by Data.
• User impact if declined: Without this information, we can't make a decision about deprecating RSA PKCS#7 addon signatures.
• Fix Landed on Version:
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): The patch adds telemetry only and has been running in Nightly.

Comment 7

[Pascal Chevrel:pascalc (PTO until April 26)]

Comment on attachment 9278510 [details]
Bug 1771523 - Add telemetry probe for app signature verification outcomes. r=keeler

Approved for 102 beta 7, thanks.

Comment 8

[Pascal Chevrel:pascalc (PTO until April 26)]

https://hg.mozilla.org/releases/mozilla-beta/rev/ca71db57421e

Comment 9

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 9278510 [details]
Bug 1771523 - Add telemetry probe for app signature verification outcomes. r=keeler

Approved for 91.11esr.

Comment 10

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-esr91/rev/1f18a7d6165e