801218 - Upgrade NSS to 3.14 Final (needs NSPR 4.9.3 final)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect, P1)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #795972 +++

NSS 3.14 is needed for WebRTC support. There were a few patches that were checked in between NSS 3.14 BETA1 and RC0/RTM. Changes:

Bug 373108: Fix bugs and disable some features in the AES-GCM implementation in Softoken/FreeBL
Bug 475578: Fix bugs in Extended DSA implementation in Softoken/FreeBL
Bug 797572: Export SRTP functions from libssl.
Bug 734492: NSS should protect itself against calls made before nss_init, r=wtc
Bug 734484: Skip module load if already initialized or no db's are being added

Version string updated to RC0

Especially because of the patches in bug 734492, bug 734484, and bug 475578, we need to make to get as much testing on Aurora as possible. So, I'd like to land this on Aurora ASAP.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: Dummy patch to get approval

[Approval Request Comment]
Bug caused by (feature/regressing bug #): bug 795987

User impact if declined: Possibly incompatibility with system NSS on Linux.

Testing completed (on m-c, etc.):

Risk to taking this patch (and alternatives if risky): There is a little risk that the changes to NSS initialization may cause regressions. So, it is important to test this patch as much as possible. Perhaps it would safest to wait a week after the mozilla-central landing.

String or UUID changes made by this patch: None.

Comment 2

[Lukas Blakk [:lsblakk] use ?needinfo]

Please go ahead with landing to mozilla-central then so we get that week's data to assess before being asked to approve for uplift to Aurora.

Comment 3

[Wan-Teh Chang]

I pushed NSS_3_14_RC1 to mozilla-inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/783cece76130

Comment 4

[Wan-Teh Chang]

Comment on attachment 671011 [details]
Dummy patch to get approval

r=wtc.

Comment 5

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/783cece76130

Comment 6

[bhavana bajaj [:bajaj]]

Waiting for this to bake on central for a couple of days to get some data before assessing risk to uplift to aurora.

Comment 7

[Kai Engert [:KaiE:]]

(In reply to bhavana bajaj [:bajaj] from comment #6)
> Waiting for this to bake on central for a couple of days to get some data
> before assessing risk to uplift to aurora.

Well, it's not a matter of risk.

Aurora currently uses a beta version - by accepting a beta version of NSS on mozilla-central, people have accepted the requirement to pick up the final version once it's done.

Final releases of Mozilla software are required to use final release versions of NSPR and NSS.

And BTW, the subject of this bug must be changed to include NSPR 4.9.3, because that's also currently checked in as a beta.

Comment 8

[Kai Engert [:KaiE:]]

Wan-Teh, what's the status of tagging NSPR 4.9.3 final release?

Comment 9

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Hi, we will check in a final release of NSS and a final release of NSPR but it is reasonable to wait a few days to make sure there are no regressions. If there are regressions then we can skip the 3.14 RTM and take the 3.14.1 RTM, or revert (parts of NSS) back to the last 3.13.x. If there are no regressions then we'll just take the NSS 3.14 RTM.

Comment 10

[bhavana bajaj [:bajaj]]

Comment on attachment 671011 [details]
Dummy patch to get approval

Approving as the patch is been on central for a few days now.

Comment 11

[Scoobidiver (away)]

Not yet pushed to Aurora.

Comment 12

[bhavana bajaj [:bajaj]]

(In reply to Wan-Teh Chang from comment #3)
> I pushed NSS_3_14_RC1 to mozilla-inbound:
> https://hg.mozilla.org/integration/mozilla-inbound/rev/783cece76130

The patch is approved for aurora, but form the latest comments it seems it has not landed yet. Can you please confirm/help land at the earliest ?

Comment 13

[Kai Engert [:KaiE:]]

I had hoped Brian would complete his work and get this landed on Aurora, as this bug is assigned to him.

And the same fix must be done for NSPR.

If I don't see a comment from Bian soon, I will help out and push NSPR 4.9.3 final and NSS 3.14 final to aurora.

Comment 14

[Kai Engert [:KaiE:]]

3.14 RC1 is identical to 3.14 RTM

Comment 15

[Kai Engert [:KaiE:]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/9cc413f943a3

Comment 16

[Josh Aas]

Thanks Kai