59162 - Root certs lib not shipped in standalone XPI

Status: VERIFIED WONTFIX

(Core :: Security: PSM, defect, P2)

Description

[Ben Bucksch (:BenB)]

Reproduce:
1. Build psm.xpi with |make build_xpi| (see build instructionos)
2. Install the xpi in a fresh (open-source) Mozilla nightly build, fresh profile
3. Visit <https://admin.he.net>

Actual result:
A warning dialog pops up, saying that the CA for the certificate is not
recognized. View the certificate to see that it is issued by "Thawte".

Expected result:
Since this particular root cert is already checked into the source, is should be
recognized. No cert dialog should pop up.

Reason:
The library containing the root certs, libnssckbi.*, is not packaged in the xpi.

I have a hacking patch. Hackish, because it uses the path
../../nss/lib/ckfw/builtins/$(PLATFORM)/libnssckbi.so
to find the library from the psm tree. Suggestions welcome. Otherwise, please
let me check in this hack - it's better than a PSM that doesn't work correctly
(because it doesn't recognize any certs unless the user does hacks).

Comment 1

[Ben Bucksch (:BenB)]

.

Comment 2

[Ben Bucksch (:BenB)]

Attachment: Proposed fix, version 1

Comment 3

[Ben Bucksch (:BenB)]

Please review.

Comment 4

[Margaret Chan]

I've heard that Brian Ryner ([e-mail]) may have done some work
in this area.  I am cc'ing to him.  Hopefully, we'll hear something from
him soon.  By the way, simply put the library in psm/components does
not seem to work for me.  It works if I place it in my profile, however.

Comment 5

[Ben Bucksch (:BenB)]

Margaret,
see <http://www.bucksch.org/1/projects/mozilla/dist/psm> for a psm.xpi, which
uses the root cert lib in components. (worksforme(tm)).

Comment 6

[John Unruh]

Mass reassigning nitinp's bugs to me.

Comment 7

[Ben Bucksch (:BenB)]

Getting schizophrenic: Moving all bugs for Beonex <http://www.beonex.com> to my
second Bugzilla identity <[e-mail]>.

Comment 8

[Ben Bucksch (:BenB)]

wtc: please find a reviewer.

Comment 9

[Javier Delgadillo]

This patch won't work.  

You need to have a line like this instead:
  $(NSINSTALL) -m 755 $(DIST)/lib/$(DLL_PREFIX)nssckbi.$(DLL_SUFFIX) xpi/psm

The components directory is only for generic modules that are xpcom-ified.  
libnssckbi.so is a PKCS#11 module that needs to live in the same directory as 
the psm executable.

Comment 10

[Ben Bucksch (:BenB)]

> This patch won't work.

I know it was a hack, but it did work for me (on Linux).

> You need to have a line like this instead:

Can you check it in, please? (iPlanet won't allow me.)

Comment 11

[Ben Bucksch (:BenB)]

> Can you check it in, please?

Note: I didn't try your line out yet. Will do at next chance.

Comment 12

[Javier Delgadillo]

Your patch will create an XPI, but it still won't have the root certs when you 
run PSM.

Comment 13

[Gervase Markham [:gerv]]

[e-mail] - what's the score with this patch? BenB - do you have a 
non-hacky version of it?

Gerv

Comment 14

[Ben Bucksch (:BenB)]

> BenB - do you have a non-hacky version of it?

No, and I can't produce one.

Comment 15

[Andreas Franke (gone)]

If you can't produce one, shouldn't you assign this bug to nobody then?
Resetting target milestone from M19 since the schedule only mentions M1-M3 and
RTM (for PSM 2.0), and M19 is meaningless for the browser by now.

Comment 16

[Ben Bucksch (:BenB)]

> Your patch will create an XPI, but it still won't have the root certs when you 
> run PSM.

WORKSFORME, unless I am missing something.

afranke, the patch is hacky, and I am open for suggestions. If anyone wants to
take the bug, feel free. I am better than nobody, though.

Comment 17

[Andreas Franke (gone)]

Ok, you're right Ben. I just wanted to make sure that it's clear that you are
not the one who will do the next step here.

Comment 18

[Brendan Eich [:brendan]]

Per javi's comments dated 2001-01-16 10:39, this bug needs a new patch.  Ben,
why can't you provide one?  WORKSFORME is not enough in light of specific review
comments.

What exactly needs to happen to make the patch not be hacky?

/be

Comment 19

[Ben Bucksch (:BenB)]

I'll defer this bug until PSM 2.0 lands, because I guess, the world will then
change (again).

Comment 20

[John Unruh]

Setting milestone to PSM 2.0.

Comment 21

[David P. Drinan]

PSM 1.x issue. Not relevant for PMS 2.

Comment 22

[John Unruh]

Verified wontfix.