528277 - Release 3.12.4 + new roots to Mozilla

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert [:KaiE:]]

We want to create a combined release based on NSS 3.12.4 plus several new CA root certificates into Mozilla.

Comment 1

[John Arild A. Johansen]

Hi, not beeing included in the current Beta4 of FireFox either...I take the liberty to submit a "request for status" for this bug.

Best regards, 
John

Comment 2

[Daniel Veditz [:dveditz]]

If this is wanted for Firefox 3.6 it may already be too late, and certainly needs to be on the release radar if it's going to make it.

Comment 3

[Johnathan Nightingale [:johnath]]

This doesn't block the release, but if it can land in the next 24 hours, it can have my approval to land.  I can't set an approval flag without a bug, but a check-in that:

- adds the new roots
- doesn't otherwise signifcantly alter NSS behaviour/functionality (i.e. doesn't introduce additional code risk)

is a=johnath.

Comment 4

[Kai Engert [:KaiE:]]

No patch for this bug.

The instructions are:
"Follow the usual procedure from https://developer.mozilla.org/en/Updating_NSPR_or_NSS_in_mozilla-central to update Mozilla to NSS tag NSS_3_12_4_WITH_CKBI_1_77_RTM."

I've verified the difference between "nss currently being used" and "new nss tag NSS_3_12_4_WITH_CKBI_1_77_RTM" is equivalent to the root additions made with nss bug 527759.

In today's NSS meeting, Bob Relyea, Nelson Bolyard and Dan Veditz have agreed to the plan to deliver the changes from bug 527759 tag to Mozilla, which I take as r+

Comment 5

[Kai Engert [:KaiE:]]

pushed to mozilla-central
http://hg.mozilla.org/mozilla-central/rev/1e627733f9c3

Comment 6

[Kai Engert [:KaiE:]]

pushed to mozilla-1.9.2
http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e7972db06977

Comment 7

[Johnathan Nightingale [:johnath]]

Kai - are you able to land this and bug 527759 on 1.9.1 in the next day or so? We're behind on getting 1.9.1.18 out the door, so if you can't get to it, I can try.

Comment 8

[Johnathan Nightingale [:johnath]]

(In reply to comment #7)
> Kai - are you able to land this and bug 527759 on 1.9.1 in the next day or so?
> We're behind on getting 1.9.1.18 out the door, so if you can't get to it, I can
> try.

by which I mean that we're behind on getting 1.9.1.8 out the door. 1.9.1.18 should be about a year away.

Comment 9

[Kai Engert [:KaiE:]]

pushed
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/96aa722da7ab