835174 - nsIX509CertDB::openSignedJARFile does not support old-style signatures (without SHA1-Digest-Manifest)

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

nsIX509CertDB::openSignedJARFile current requires the SHA1-Digest-Manifest in the JAR file, which is technically optional. We do this because relying on SHA1-Digest-Manifest is safer, because it is simpler and because it allows us to process much less untrusted input prior to verifying the signature.

However, the tool in NSS for signing jar files does not add the SHA1-Digest-Manifest attribute when signing, so we can't expect extension developers to have SHA1-Digest-Manifest in their extensions. Consequently, in order for Toolkit to switch to openSignedJARFile for verifying extension signatures, we need to add an option for openSignedJARFile to accept the old (less safe) kind of signature.

Comment 1

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

AMO is the only entity doing add-on signing now, so we don't have to support this if we don't want to.