1832523 - Optionally use NSS for MAR signature verification on Windows/macOS

Status: RESOLVED FIXED

(Toolkit :: Application Update, enhancement)

Description

[Pier Angelo Vendrame]

In Tor Browser, we modify the updater and the mar tools to use NSS on all platforms, including Windows and macOS, where normally OS libraries are used.
Recently, we've modified our patch to do so only when a build flag is specified (at the moment --enable-nss-mar), because we would like to upstream it.

Comment 1

[Pier Angelo Vendrame]

Attachment: Bug 1832523 - Allow using NSS to sign and verify MAR signatures. r?#application-update-reviewers,glandium

Allow using NSS for checking MAR signatures also in platforms where
OS-native APIs are used by default, i.e., macOS and Windows.

To make the updater find the NSS and NSPR libraries it depends on at
runtime, we add the firefox directory to the shared library search path
on macOS.
On Linux, rpath is used to solve that problem, but that approach will
not work on macOS because the updater executable is copied during the
update process to a location that can vary.

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/f16132e5640c
Allow using NSS to sign and verify MAR signatures. r=application-update-reviewers,glandium,bytesized

Comment 3

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/f16132e5640c