824199 - Replace the marketplace-dev cert with the marketplace-prod test cert in Gecko

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Note: This will cause installation of packaged apps from marketplace-dev to stop working unless/until the marketplace-dev cert is loaded into the user profile certificate database. I filed bug 824198 about allowing marketplace-dev to continue working.

Unfortunately, most PSM peers (including me) are gone for the holidays, so I am not sure who can review this patch. Since this is B2G-only and urgent, I will let anybody from the broader apps team who can verify that the certificate matches the certificate being used on the prod server r+ the patch.

Note that this patch modifies the test_signed_apps-marketplace.js testcase to replace the marketplace-dev test app with a prod-cert-signed app.

An alternative to replacing the marketplace-dev cert with the prod (test) cert is to just have BOTH of them live in Gecko temporarily. To do that, look at the instructions in Gecko's security/build/b2g-certdata.mk and adjust them to something like:

1. Replace ./b2g-app-root-cert.der with the new DER-encoded root cert for the marketplace-prod.

2. Add ./b2g-dev-app-root-cert.der with the new DER-encoded root cert marketplace-dev.

3. In this directory run:

     PATH=$NSS/bin:$NSS/lib addbuiltin -n "b2g-app-root-cert" -t ",,Cu" \
       < b2g-app-root-cert.der > b2g-certdata.txt
     PATH=$NSS/bin:$NSS/lib addbuiltin -n "b2g-dev-app-root-cert" -t ",,Cu" \
       < b2g-app-root-cert.der >> b2g-certdata.txt

4. Commit the changes.

Yet another possibility is to have the people who need to test marketplace-prod use the scripts I am going to attach to bug 824198 to import the marketplace-prod cert into their phones themselves, and then wait until PSM people become available again.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: Replace the marketplace-dev cert with the marketplace-prod test cert in Gecko

Comment 2

[Ryan Tilder [:rtilder]]

Comment on attachment 695088 [details] [diff] [review]
Replace the marketplace-dev cert with the marketplace-prod test cert in Gecko

Review of attachment 695088 [details] [diff] [review]:
-----------------------------------------------------------------

Looks good with the extensions.

Comment 3

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/3e370d74c3a8
https://hg.mozilla.org/releases/mozilla-b2g18/rev/7471c5ac48af

Comment 5

[Jason Smith [:jsmith]]

Closing per work week checkin policy - inbound + b2g18 = resolved fixed.

Comment 6

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3e370d74c3a8