582575 - Add July 2010 batch of roots to NSS

Status: RESOLVED FIXED

(NSS :: CA Certificates Code, task, P2)

Description

[Kai Engert [:KaiE:]]

Add July 2010 batch of roots to NSS

See dependency list.

Comment 1

[Eddy Nigg (StartCom)]

Some clarifications are needed due to bug 582531.

Comment 2

[Kathleen Wilson]

Kai, Given bug 582531, I think we should postpone 562395 for now, and remove it from this batch of changes.

Comment 3

[Kai Engert [:KaiE:]]

ok. removing 562395.

Comment 4

[Kai Engert [:KaiE:]]

Attachment: Patch v1

Enabling the roots from the bugs listed in the dependency list.

Not yet requesting code review, pending test results from CAs.

Comment 5

[Kai Engert [:KaiE:]]

Removing Izpene root and bug from this batch.

Comment 6

[Kai Engert [:KaiE:]]

We have confirmation based on test binaries from 4 CAs and their 5 new roots.

I'll attach a new patch that no longer includes Izpene and request review.

Comment 7

[Kai Engert [:KaiE:]]

Attachment: Patch v2

Nelson, would you be able to help to review this?
Thanks a lot in advance for letting us know.

(Note this patch excludes the automatically generated certdata.c but I indeed ran gmake generate to produce it and of course will check it in when landing this)

Comment 8

[Reed Loden [:reed]]

Should bug 582375 be held off due to problems mentioned in bug 507360, comment #23?

Comment 9

[Kai Engert [:KaiE:]]

Comment on attachment 463702 [details] [diff] [review]
Patch v2

(In reply to comment #8)
> Should bug 582375 be held off due to problems mentioned in bug 507360, comment
> #23?

I've filed bug 586414 and will remove the GlobalSign root from the current batch.

Comment 10

[Kai Engert [:KaiE:]]

Attachment: Patch v3

This is a subset of the patch that was used for testing. It has GlobalSign removed, will be postponed to a future batch.

All of these certificates look fine without any known issues.

Nelson, can you please review?

(as usual, certdata.c excluded)

Comment 11

[Kai Engert [:KaiE:]]

One more thing, given that we have agreed to keep the list of root CAs identical on NSS-Trunk and NSS-Stable-Branch,
I propose to keep the version numbers identical, as long as we continue to have them in sync.

(In particular, let's continue to use the roots-module version numbers dedicated to the 3.12 branch on both branch and trunk.)

Comment 12

[Kai Engert [:KaiE:]]

Bug 586414 has been marked as resolved fixed, so I'm including GlobalSign again.

Comment 13

[Kai Engert [:KaiE:]]

Comment on attachment 463702 [details] [diff] [review]
Patch v2

Marking patch v2 as active again.
Sorry for going back and forth, I think we're now final for this batch.

Nelson, could you please review?

Comment 14

[Nelson Bolyard (seldom reads bugmail)]

will review attachment 463702 [details] [diff] [review].

Comment 15

[Kai Engert [:KaiE:]]

(In reply to comment #14)
> will review attachment 463702 [details] [diff] [review].

Correct, thanks!

Comment 16

[Nelson Bolyard (seldom reads bugmail)]

Comment on attachment 463702 [details] [diff] [review]
Patch v2

r=nelson

Comment 17

[Kai Engert [:KaiE:]]

Checked in to NSS trunk for future NSS 3.13

cvs commit: Examining .
Checking in certdata.c;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/certdata.c,v  <--  certdata.c
new revision: 1.68; previous revision: 1.67
done
Checking in certdata.txt;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/certdata.txt,v  <--  certdata.txt
new revision: 1.65; previous revision: 1.64
done
Checking in nssckbi.h;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/nssckbi.h,v  <--  nssckbi.h
new revision: 1.25; previous revision: 1.24
done

Comment 18

[Kai Engert [:KaiE:]]

Checked in to NSS 3.12 branch for 3.12.8

cvs commit: Examining .
Checking in certdata.c;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/certdata.c,v  <--  certdata.c
new revision: 1.67.2.1; previous revision: 1.67
done
Checking in certdata.txt;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/certdata.txt,v  <--  certdata.txt
new revision: 1.64.2.1; previous revision: 1.64
done
Checking in nssckbi.h;
/cvsroot/mozilla/security/nss/lib/ckfw/builtins/nssckbi.h,v  <--  nssckbi.h
new revision: 1.24.2.1; previous revision: 1.24
done


fixed