197877 - PSM should upgrade to NSS 3.8.

Status: VERIFIED FIXED

(Core Graveyard :: Security: UI, defect)

Description

[Wan-Teh Chang]

PSM should upgrade to the upcoming NSS 3.8 release.
We need to make at least two PSM changes.
1. PSM needs to build the new NSS tool "shlibsign"
and generate the *.chk FIPS checksum files with it.
2. The new *.chk FIPS checksum files need to be
installed in the appropriate directories and packaged
in the GRE and Mozilla installers.

Comment 1

[Wan-Teh Chang]

Attachment: Proposed patch v1 (build shlibsign and generate *.chk)

This patch is incomplete.  Still need to install and
package the *.chk files.

Comment 2

[Wan-Teh Chang]

Attachment: Proposed patch v2

I think this patch has all the necessary changes
for PSM.  Kai, could you review this patch?

There are three *.chk files in NSS 3.8.
1. libsoftokn3.chk/softokn3.chk.
2. libfreebl_hybrid_3.chk.
3. libfreebl_pure32_3.chk.

All platforms have the first one.  Only 32-bit Solaris
SPARC and HP-UX PA-RISC have the second and third ones.

These *.chk files need to be installed in the same
directory as the corresponding shared library/DLL.

Comment 3

[Kai Engert [:KaiE:]]

Comment on attachment 117569 [details] [diff] [review]
Proposed patch v2

looks ok to me.
r=kaie

Comment 4

[Wan-Teh Chang]

Attachment: Proposed patch v3

The only difference from the previous version of the patch
is that the .chk files are installed with 644 permissions
(instead of 755) because the .chk files do not need
execute permissions.

Comment 5

[Kai Engert [:KaiE:]]

Comment on attachment 117607 [details] [diff] [review]
Proposed patch v3

r=kaie

Comment 6

[Brian Ryner (not reading)]

Comment on attachment 117607 [details] [diff] [review]
Proposed patch v3

If these .chk files are required in order for PSM to operate correctly, they
should also be added to the packages-* files in xpinstall/packager; and to the
embedding manifests in embedding/config (basebrowser-*).

Comment 7

[Wan-Teh Chang]

Brian,

Excellent point.  I do have patches for the packages-* files in
xpinstall/packager and the embedding manifests in embedding/config
(basebrowser-*).  They are attachment 117568 [details] [diff] [review] and attachment 117567 [details] [diff] [review]
for bug 197874.  I would appreciate it if you could super review
these three patches.

Please let me know if I missed anything else.

Comment 8

[Wan-Teh Chang]

Patch checked in.  Kai, please set the target milestone.

Comment 9

[John Unruh]

Verified per wtc's comment.