385198 - Upgrade NSS on Moz 1.8 branch to pick up new root CA certs

Status: VERIFIED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert (:KaiE:)]

As of today, MOZILLA_1_8_BRANCH uses NSS_3_11_5_RTM.

We recently created a new release of the builtin roots module included in NSS, version 1.64, which includes the new root CA certs checked in recently to the NSS 3.11 branch. The module was released independently of the rest of NSS.

A cvs tag got created that is a combination of NSS 3.11.5 with CKBI 1.64:
  NSS_3_11_5_WITH_CKBI_1_64_RTM

Mozilla 1.8 branch may upgrade to this new tag.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Patch v1

Comment 2

[Gervase Markham [:gerv]]

Wonderful :-) Background for drivers: the NSS team has agreed to support the code found at this tag. It is their approved method of upgrading the NSS root certificate store to include recently-added certs without upgrading the rest of NSS. Moving to this tag should not (correct me if I'm wrong, kai or nelson) affect the FIPS status (validated or otherwise) of Firefox.

Gerv

Comment 3

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 269089 [details] [diff] [review]
Patch v1

Look right to me. 
Thanks, Kai!

Comment 4

[Nelson Bolyard (seldom reads bugmail)]

(In reply to comment #2)
> Moving to this tag should not [..] affect the FIPS status (validated or 
> otherwise) of Firefox.

Right.  That's the whole idea.

Comment 5

[Daniel Veditz [:dveditz]]

Comment on attachment 269089 [details] [diff] [review]
Patch v1

approved for 1.8.1.5, a=dveditz for release-drivers

Comment 6

[Kai Engert (:KaiE:)]

fixed on branch only

(but trunk currently uses the same NSS snapshot)

Comment 7

[Al Billings [:abillings - ex-MoCo]]

Verified that this is checked into the tree for branch.