1815435 - Upgrade Firefox 112 to use NSS 3.89

Status: RESOLVED FIXED

(Core :: Security: PSM, task, P1)

Description

[Kai Engert [:KaiE:]]

Upgrade Firefox 112 to use NSS 3.89

Comment 1

[Kai Engert [:KaiE:]]

NSS 3.88 has branched, so it seems time to set NSS default branch to version 3.89 beta

Comment 2

[Dennis Jackson]

Hi Kai,

We have our own internal rotation and schedule for NSS Releases. We're currently in the freeze period between tagging NSS 3.88 and releasing it on Thursday, after which the default branch will change. FWIW, we would have been happy to take your ABI patch in 3.88.

Comment 3

[Kai Engert [:KaiE:]]

Hello, are you ready to uplift an NSS pre-3.89 snapshot into mozilla-central?

Comment 4

[Kai Engert [:KaiE:]]

Perhaps revision 056fbe59c60555d6ca93d7d40c675955f1a9aa2c from 4 days ago could be a candidate for early testing of recent NSS changes in mozilla-central?
(This would avoid the changes around liboqs that Bob has started yesterday.)

I'm asking because I'm waiting for the changes from bug 1815246.

Comment 5

[John Schanck [:jschanck]]

We're scheduled to uplift a beta on Thursday. Do you need it sooner?

Comment 6

[Kai Engert [:KaiE:]]

that's fine, thanks!

Comment 7

[John Schanck [:jschanck]]

Attachment: Bug 1815435 - land NSS NSS_3_89_BETA1 UPGRADE_NSS_RELEASE, r=keeler

Comment 8

[John Schanck [:jschanck]]

FYI, Kai, I didn't add NSS_CMSSignerInfo_GetDigestAlgTag to security/nss.symbols. You can do that when you add the new code that uses it.

Comment 9

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/692727a38d4d
land NSS NSS_3_89_BETA1 UPGRADE_NSS_RELEASE, r=keeler

Comment 10

[Sandor Molnar[:smolnar]]

Backed out for causing for causing build bustages in security/nss/lib/ssl/ssl3ext.c

Backout link: https://hg.mozilla.org/integration/autoland/rev/93cf1f7fdc528e57291e05b4be7f7a84a254f1f2

Push with failures

Failure log -> security/nss/lib/ssl/ssl3ext.c:1141:27: error: result of comparison of 5-bit unsigned value < 256 is always true [-Werror,-Wtautological-value-range-compare]

Comment 11

[John Schanck [:jschanck]]

Looks like a problem with the fixup patch for Bug 1789436. Can you take a look, Dennis?

Comment 12

[Dennis Jackson]

This seems like a very noisy heuristic. See previous bug 1796308 where the chosen fix was to work around the issue by erasing the size information for the constant. I'll get this fixed today in 1820175.

Comment 13

[John Schanck [:jschanck]]

Attachment: Bug 1815435 - land NSS NSS_3_89_BETA2 UPGRADE_NSS_RELEASE, r=keeler

Comment 14

[Kai Engert [:KaiE:]]

(In reply to John Schanck [:jschanck] from comment #8)

FYI, Kai, I didn't add NSS_CMSSignerInfo_GetDigestAlgTag to security/nss.symbols. You can do that when you add the new code that uses it.

Thanks, not adding is the right thing to do, because Firefox doesn't need the symbol.
I will add the symbol to Thunderbird's file of the additional NSS symbols it needs.
https://searchfox.org/comm-central/source/mailnews/nss-extra.symbols

Will an updated NSS 3.89 beta snapshot get landed into mozilla-central today?

Comment 15

[John Schanck [:jschanck]]

Yes, we'll land a beta today.

Comment 16

[John Schanck [:jschanck]]

Attachment: Bug 1815435 - land NSS NSS_3_89_BETA3 UPGRADE_NSS_RELEASE, r=djackson

Comment 17

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/48c77e0f9262
land NSS NSS_3_89_BETA3 UPGRADE_NSS_RELEASE, r=djackson

Comment 18

[Cristian Tuns]

Backed out for causing xpcshell failures in test_cert_overrides.js

• Backout link
• Push with failures
• Failure Log
• Failure line: TEST-UNEXPECTED-FAIL | security/manager/ssl/tests/unit/test_cert_overrides.js | xpcshell return code: 0

Comment 19

[John Schanck [:jschanck]]

Attachment: Bug 1815435 - land NSS NSS_3_89_BETA4 UPGRADE_NSS_RELEASE, r=keeler

Comment 20

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/10e0999ede50
land NSS NSS_3_89_BETA4 UPGRADE_NSS_RELEASE, r=keeler

Comment 21

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/10e0999ede50

Comment 22

[John Schanck [:jschanck]]

Attachment: Bug 1815435 - land NSS NSS_3_89_RTM UPGRADE_NSS_RELEASE, r=keeler

Comment 23

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f7927075967f
land NSS NSS_3_89_RTM UPGRADE_NSS_RELEASE, r=keeler

Comment 24

[Cosmin Sabou [:CosminS]]

https://hg.mozilla.org/mozilla-central/rev/f7927075967f