898431 - Update Mozilla to use NSS that support false start and OCSP GET (likely 3.15.4) (once it's ready)

Status: RESOLVED FIXED

(Core :: Security: PSM, defect)

Description

[Kai Engert (:KaiE:)]

Update Mozilla 25 to use NSS 3.15.2 (once it's ready)

The NSS 3.15.2 release is apparently required to support bug 658222, which currently relies on a non-released patch, applied locally in mozilla-central.

Comment 1

[Kai Engert (:KaiE:)]

Just created a NSS_3_15_2_BETA2 tag.
Should be pushed to mozilla-central.

Comment 2

[Kai Engert (:KaiE:)]

We'd like to create a final release of NSS 3.15.2 in the next few days, ideally early next week.

The driver for the release is bug 713933, which is currently waiting for Wan-Teh's review. The hope is to get that done and released, prior to next Tuesday, prior to having Mozilla's patched version of NSS being escalated into mozilla-beta.

Optionally bug 909162 and bug 915408 might get included, if they happen to be ready in time, too.

Comment 3

[Kai Engert (:KaiE:)]

This affects mozilla25, the upgrade to a released version of NSS 3.15.2 is mandatory, so I'm requesting approval for aurora, which currently is mozilla25.

(In case this work cannot be done prior to Tuesday (Sep 16), we'll have to ask for beta approval, too.)

Comment 4

[Alex Keybl [:akeybl]]

This won't make it onto Aurora 25, so we'll have to take this on Beta (for next week) if we agree on risk/reward. Please expedite as much as possible.

Comment 5

[BoerenkoolMetWorst]

Please take it on Beta, reward is high as 3.15.2 also includes more secure AES-GCM ciphers.

Comment 6

[Wan-Teh Chang]

NSS_3_15_2_BETA2 pushed to mozilla-inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/0800319e3694

Comment 7

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/0800319e3694

Comment 8

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

For mozilla-beta, see the patch in bug 920248 that reverts NSS to an unmodified NSS 3.15.1 RTM. We won't need to uplift NSS 3.15.2 to Firefox 25 once we check in that patch.

Comment 9

[Wan-Teh Chang]

Kai: given the new plan, I propose that you change the version strings on
the NSS trunk to final and create the NSS_3_15_2_RTM hg tag. The only change
since NSS_3_15_2_BETA2 should be this checkin:
https://hg.mozilla.org/projects/nss/rev/141fae8fb2e8

I'll be happy to review your NSS_3_15_2_RTM hg tag before you announce or
use it. Thanks.

Comment 10

[Kai Engert (:KaiE:)]

Sure, let's release 3.15.2 now - without false start fixes.

However, what's the plan for mozilla 26 (currently aurora) ?

According to bug 920248, at this time, you propose to simply disable the pref in mozilla 26, but keep the code checked in?

This means, the target of this bug changes to aurora 26, I'm updating the subject.

Since you keep the code on aurora 26 (instead of backing out like on beta 25),
we will still require an updated NSS.

Since you propose to release NSS 3.15.2 without the needed code, you'll require NSS 3.15.3 containing a fixed bug 713933 within the next 4 weeks. Is that your updated plan?

Comment 11

[Kai Engert (:KaiE:)]

Bug 920248 is now intended to cleanup mozilla beta 25,
and this bug should get flags for mozilla 26

Comment 12

[Alex Keybl [:akeybl]]

(In reply to Brian Smith (:briansmith, was :[e-mail]) from comment #8)
> For mozilla-beta, see the patch in bug 920248 that reverts NSS to an
> unmodified NSS 3.15.1 RTM. We won't need to uplift NSS 3.15.2 to Firefox 25
> once we check in that patch.

Thanks, no longer tracking for FF25.

Comment 13

[Kai Engert (:KaiE:)]

(In reply to Alex Keybl [:akeybl] from comment #12)
> (In reply to Brian Smith (:briansmith, was :[e-mail]) from comment
> #8)
> > For mozilla-beta, see the patch in bug 920248 that reverts NSS to an
> > unmodified NSS 3.15.1 RTM. We won't need to uplift NSS 3.15.2 to Firefox 25
> > once we check in that patch.
> 
> Thanks, no longer tracking for FF25.

Right, for the original motiviation cited in this bug, it's no longer necessary. This bug here only tracks FF26 and newer.

However, please see bug 921090 which now tracks FF25.

Comment 14

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Since false start is disabled in mozilla-central, this doesn't depend on bug 713933 any more. However, we either need to land bug 932176 at the same time as we land NSS 3.15.3, or we need to write the tests for bug 871954. It seems like the tests for bug 871954 are going to take longer to do than it will take to land bug 932176.

Comment 15

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

NSS_3_15_3_BETA2 pushed:
https://hg.mozilla.org/integration/mozilla-inbound/rev/73e07f2487db

Comment 16

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/73e07f2487db

Comment 17

[Kai Engert (:KaiE:)]

Removing target version from bug summary.

Comment 18

[Kai Engert (:KaiE:)]

I believe this bug no longer targets Mozilla 26. Should the tracking26 flags be cleared?

Comment 19

[Kai Engert (:KaiE:)]

It's not clear if this targets mozilla27 or mozilla28.

It might target mozilla27, as Brian hasn't yet backed out the false start work from mozilla27.
We'll see if it gets ready in time.

Comment 20

[Lukas Blakk [:lsblakk] use ?needinfo]

removing 26 tracking in that case, will see if this makes 27.

Comment 21

[Kai Engert (:KaiE:)]

We must test the new alternative NSS version 3.15.3, a NSS_3_15_3_BETA3 tag already exists. This update be tracked in bug 935959.

However, current mozilla-central uses an alternative branch, with different work, that's also named 3.15.3, beta2. That work has been renumbered and will become 3.15.4.

We should clean up potential confusion.

One of the patches going into the NEW 3.15.3 is NOT YET being tested on mozilla-central.

Ideally, the least confusing approach would be: Test the new 3.15.3 on mozilla-central.

Unfortunately, this least confusing approach would require us to back out several application level changes from PSM in mozilla-central...

Therefore I propose:

- create a NSS 3.15.4 Beta1 tag, which includes all the patches going into 3.15.3,
  and land it into mozilla-central ASAP

- land the NEW 3.15.3 into mozilla-aurora, allowing this combination of patches
  to get some testing, prior to uplifting it to the stable branches like 26 and ESR 24.

Comment 22

[Kai Engert (:KaiE:)]

> One of the patches going into the NEW 3.15.3 is NOT YET being tested on
> mozilla-central.
> ...
> - create a NSS 3.15.4 Beta1 tag, which includes all the patches going into
>   3.15.3, and land it into mozilla-central ASAP

https://hg.mozilla.org/integration/mozilla-inbound/rev/f396166fb1a5

Comment 23

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/f396166fb1a5

Comment 24

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

landed NSS_3_15_4_BETA2: https://hg.mozilla.org/integration/mozilla-inbound/rev/61fb80e560de

Comment 25

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Attachment: NSS_3_15_4_BETA2-with-configure.in-bump.patch

[Approval Request Comment]
Bug caused by (feature/regressing bug #): 

User impact if declined: Cannot uplift TLS 1.2 (bug 861266), TLS False Start (bug 920248, perf), or new cipher suite list (bug 934663, perf). Possibly problems on Linux systems that use system NSS due to changes in the default OCSP logic that are disabled in the patch for bug 928142. All of those bugs depend on NSS 3.15.4.

Testing completed (on m-c, etc.): Most of NSS 3.15.4 has been on mozilla-central since 2013-11-01. Some of the changes (false start) were even on mozilla-aurora until we switched mozilla-aurora to NSS 3.15.3 last week.

Risk to taking this patch (and alternatives if risky): There were changes to NSS's OCSP behavior that are only partially tested in Gecko's test suite. Unfortunately, this is a catch-22: in order to disable the new behavior until we've tested it, we need to update to the new version that actually makes the change, because that new version is the only version that allows us to disable the new behavior.

String or IDL/UUID changes made by this patch: None

This uplift is very important because of the OCSP GET issue and also because we'd like to uplift at least some of the functionality mentioned above to mozilla-aurora this week as well. The sooner we uplift NSS 3.15.4, the less risk there will be to doing the other changes.

Please approve bug 928142 for uplift at the same time.

Comment 26

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

BTW, the NSS update command sequence is:

hg pull m-c
hg pull -u m-a
python client.py update_nss NSS_3_15_4_BETA2
hg add security/nss/tests/chains/scenarios/method.cfg
hg commit -m "Bug 898431: Update to NSS 3.15.4 beta 2 (NSS_3_15_4_BETA2), r=me, a=?"
<apply the patch in this bug to bump the required version number in configure.in>
hg graft 8dbd3f432835

> Please approve bug 928142 for uplift at the same time.

I meant bug 932176. (Bug 928142 is the NSS bug for adding the option; bug 932176 is the bug for using that option in Gecko.)

Comment 27

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Kai Engert (:kaie) from comment #22)
> > One of the patches going into the NEW 3.15.3 is NOT YET being tested on
> > mozilla-central.
> > ...
> > - create a NSS 3.15.4 Beta1 tag, which includes all the patches going into
> >   3.15.3, and land it into mozilla-central ASAP
> 
> https://hg.mozilla.org/integration/mozilla-inbound/rev/f396166fb1a5

<briansmith> BTW, there is a step three: back out NSS 3.15.4 beta 1

https://hg.mozilla.org/integration/mozilla-inbound/rev/9f5ebea82f7e

security/nss/TAG-INFO is now NSS_3_15_3_BETA2 on mozilla-inbound.

Comment 28

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Relanded NSS_3_15_4_BETA2:
https://hg.mozilla.org/integration/mozilla-inbound/rev/a7c14ac087de

The conclusion from bug-hunting that we did that caused us to back out NSS_3_15_4 turned out to be incorrect, after further review. Further, backing out NSS_3_15_4_BETA2 re-introduced bug 935847 and other significant bugs. So, the cure was worse than the disease, especially since the cure doesn't seem likely to cure anything.

Comment 29

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/a7c14ac087de

Comment 30

[bhavana bajaj [:bajaj]]

(In reply to Brian Smith (:briansmith, was :bsmith; Please NEEDINFO? me if you want a response) from comment #25)
> Created attachment 830023 [details] [diff] [review]
> NSS_3_15_4_BETA2-with-configure.in-bump.patch
> 
> [Approval Request Comment]
> Bug caused by (feature/regressing bug #): 
> 
> User impact if declined: Cannot uplift TLS 1.2 (bug 861266), TLS False Start
> (bug 920248, perf), or new cipher suite list (bug 934663, perf). Possibly
> problems on Linux systems that use system NSS due to changes in the default
> OCSP logic that are disabled in the patch for bug 928142. All of those bugs
> depend on NSS 3.15.4.
> 
> Testing completed (on m-c, etc.): Most of NSS 3.15.4 has been on
> mozilla-central since 2013-11-01. Some of the changes (false start) were
> even on mozilla-aurora until we switched mozilla-aurora to NSS 3.15.3 last
> week.
> 
> Risk to taking this patch (and alternatives if risky): There were changes to
> NSS's OCSP behavior that are only partially tested in Gecko's test suite.
> Unfortunately, this is a catch-22: in order to disable the new behavior
> until we've tested it, we need to update to the new version that actually
> makes the change, because that new version is the only version that allows
> us to disable the new behavior.
> 
> String or IDL/UUID changes made by this patch: None
> 
> This uplift is very important because of the OCSP GET issue and also because
> we'd like to uplift at least some of the functionality mentioned above to
> mozilla-aurora this week as well. The sooner we uplift NSS 3.15.4, the less
> risk there will be to doing the other changes.
> 
> Please approve bug 928142 for uplift at the same time.

Don't see any nomination in 928142 yet. That is needed for this to land, correct ?

Comment 31

[bhavana bajaj [:bajaj]]

(In reply to bhavana bajaj [:bajaj] from comment #30)
> (In reply to Brian Smith (:briansmith, was :bsmith; Please NEEDINFO? me if
> you want a response) from comment #25)
> > Created attachment 830023 [details] [diff] [review]
> > NSS_3_15_4_BETA2-with-configure.in-bump.patch
> > 
> > [Approval Request Comment]
> > Bug caused by (feature/regressing bug #): 
> > 
> > User impact if declined: Cannot uplift TLS 1.2 (bug 861266), TLS False Start
> > (bug 920248, perf), or new cipher suite list (bug 934663, perf). Possibly
> > problems on Linux systems that use system NSS due to changes in the default
> > OCSP logic that are disabled in the patch for bug 928142. All of those bugs
> > depend on NSS 3.15.4.
> > 
> > Testing completed (on m-c, etc.): Most of NSS 3.15.4 has been on
> > mozilla-central since 2013-11-01. Some of the changes (false start) were
> > even on mozilla-aurora until we switched mozilla-aurora to NSS 3.15.3 last
> > week.
> > 
> > Risk to taking this patch (and alternatives if risky): There were changes to
> > NSS's OCSP behavior that are only partially tested in Gecko's test suite.
> > Unfortunately, this is a catch-22: in order to disable the new behavior
> > until we've tested it, we need to update to the new version that actually
> > makes the change, because that new version is the only version that allows
> > us to disable the new behavior.
> > 
> > String or IDL/UUID changes made by this patch: None
> > 
> > This uplift is very important because of the OCSP GET issue and also because
> > we'd like to uplift at least some of the functionality mentioned above to
> > mozilla-aurora this week as well. The sooner we uplift NSS 3.15.4, the less
> > risk there will be to doing the other changes.
> > 
> > Please approve bug 928142 for uplift at the same time.
> 
> Don't see any nomination in 928142 yet. That is needed for this to land,
> correct ?

whoops, just saw comment #26, nvm

Comment 32

[Kai Engert (:KaiE:)]

Brian, are you sure you want to update aurora to 3.15.4-beta? Wouldn't it be better to wait until 3.15.4-rtm?

Comment 33

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/35c1e12a0772

(In reply to Kai Engert (:kaie) from comment #32)
> Brian, are you sure you want to update aurora to 3.15.4-beta? Wouldn't it be
> better to wait until 3.15.4-rtm?

Yes, because we need to get as much testing of TLS 1.2 on beta as we can, and 3.15.4 RTM won't be ready for at least another week, I think.

Comment 34

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

NSS 3.15.4 BETA 3 (NSS_3_15_4_BETA3):
https://hg.mozilla.org/integration/mozilla-inbound/rev/35c1e12a0772
https://hg.mozilla.org/releases/mozilla-aurora/rev/7c8ba61dabfe

Note that I updated configure.in on mozilla-aurora to refer to NSS 3.15.4

Comment 35

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/35c1e12a0772

Comment 36

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

My patch for mozilla-central did not remove the references to the private false start patch in security/patches. I removed them with this checkin:
https://hg.mozilla.org/integration/mozilla-inbound/rev/270522e6c504

Comment 37

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/270522e6c504

Comment 38

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

beta 4: https://hg.mozilla.org/releases/mozilla-aurora/rev/3cbce21d4d69

Comment 39

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

beta 4 with private patch from bug 935831 re-applied:
https://hg.mozilla.org/integration/mozilla-inbound/rev/08e1c88ba2be

Comment 40

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/08e1c88ba2be

Comment 41

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

beta 5, removing the private patch for bug 935831 since a proper fix for that bug was added to NSS.
https://hg.mozilla.org/integration/mozilla-inbound/rev/c3b13e75034a

Comment 42

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c3b13e75034a

Comment 43

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

python client.py update_nss NSS_3_15_4_BETA6:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9e9d5098d95f
https://hg.mozilla.org/releases/mozilla-aurora/rev/731470a7c4ca

Comment 44

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/9e9d5098d95f

Comment 45

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Beta 7:
https://hg.mozilla.org/integration/mozilla-inbound/rev/056164bcce96
https://hg.mozilla.org/releases/mozilla-aurora/rev/d53119cbd9e5

Comment 46

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/056164bcce96

Comment 47

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Beta 8 (fixes root module version):
https://hg.mozilla.org/integration/mozilla-inbound/rev/3e6cb82b10b6
https://hg.mozilla.org/releases/mozilla-aurora/rev/1a29647ca0a6

Comment 48

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/3e6cb82b10b6

Comment 49

[Kai Engert (:KaiE:)]

3.15.4 is not yet released, it got delayed by bug 942152 (because it wasn't clear how to deal with it).

You should probably back out the NSS beta from aurora 27, which will turn into beta 27 tomorrow.

Comment 50

[u279076]

Brian, what are the implications of this change for our users? Is there anything QA should be looking out for in Firefox 28?

Comment 51

[Landry Breuil (:gaston)]

(In reply to Kai Engert (:kaie) from comment #49)
> 3.15.4 is not yet released, it got delayed by bug 942152 (because it wasn't
> clear how to deal with it).
> 
> You should probably back out the NSS beta from aurora 27, which will turn
> into beta 27 tomorrow.

Yes, as of now it's impossible to build 27.0b2 using --with-system-nss, because 3.15.4 is still unavailable.

configure:15076: checking for NSS - version >= 3.15.4
configure: error: you don't have NSS installed or your version is too old

It's not the first time it happens, and is annoying for distributors. Please stop depending on unreleased versions...

Comment 52

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Landry Breuil (:gaston) from comment #51)
> Yes, as of now it's impossible to build 27.0b2 using --with-system-nss,
> because 3.15.4 is still unavailable.
> 
> It's not the first time it happens, and is annoying for distributors. Please
> stop depending on unreleased versions...

Let's take this discussion to dev-tech-crypto, instead of having it here.

Comment 53

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

(In reply to Anthony Hughes, QA Mentor (:ashughes) from comment #50)
> Brian, what are the implications of this change for our users? Is there
> anything QA should be looking out for in Firefox 28?

The main risk is that some compatibility issue will cause some SSL websites to stop working. See bug 946147 for example. Last week, I met with mwobensmith about doing a semi-automatic compatibility verification across a very large number of SSL servers, to verify that we haven't regressed compatibility. I am going to be talking to him again today. I suggest you follow up with mwobensmith tomorrow.

Comment 54

[u279076]

Thanks Brian, for now I'm flagging this to be verified as you suggested, exploratory testing of many SSL websites.

Comment 55

[Bogdan Maris, Desktop QA]

We performed further exploratory testing around some SSL websites starting with the list provided by Brian in bug 946147 in comment 7, using latest Aurora 28.0a2 under different OS`s. No new issues were found except some warnings related to RFC 5746. For more details please take a look at https://etherpad.mozilla.org/Fx28-0a2-TLS-SSL. 
Based on the above I`m marking this as verified fixed on 28.0a2.

Comment 56

[Wan-Teh Chang]

NSS_3_15_4_BETA9 pushed to mozilla-inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/81ab8a7cca29

I expect NSS_3_15_4_BETA9 to be the last NSS 3.15.4 Beta. Because of the upcoming
holidays, I want to wait until we come back to work on January 2nd to release
NSS_3_15_4_RTM.

Comment 57

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/81ab8a7cca29

Comment 58

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Pushed NSS_3_15_4_BETA10 to mozilla-inbound:
https://hg.mozilla.org/integration/mozilla-inbound/rev/c946ccc4cafa

Comment 59

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/c946ccc4cafa

Comment 60

[Kai Engert (:KaiE:)]

The release notes aren't ready yet, but the 3.15.4 RTM has been tagged. You probably want to update the mozilla-beta and mozilla-aurora branches to pick it up ASAP. Brian, do you want to work on that?

Comment 61

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

https://hg.mozilla.org/integration/mozilla-inbound/rev/acce7a37a66c
https://hg.mozilla.org/releases/mozilla-aurora/rev/c255d955ea6c
https://hg.mozilla.org/releases/mozilla-beta/rev/2c2ee62fd2fa

I also accidentally landed this on the release branch:
https://hg.mozilla.org/releases/mozilla-beta/rev/fee4c481bf7c
I backed that out:
https://hg.mozilla.org/releases/mozilla-beta/rev/5a761aaec7a2

Comment 63

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/acce7a37a66c

Comment 64

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 830023 [details] [diff] [review]
NSS_3_15_4_BETA2-with-configure.in-bump.patch

[Approval Request Comment]
User impact if declined: Security bugs fixed in NSS 3.15.4 will be present in ESR 24, and/or the various B2G versions.
Testing completed: Landed on mozilla-central, mozilla-aurora, and mozilla-beta incrementally over the last few weeks with no regressions. Final version has been on all three of those channels since Monday, and on mozilla-central since last week.

Risk to taking this patch (and alternatives if risky): There are changes in NSS 3.15.4 other than the security bug fixes. The changes to OCSP and cipher suite configuration are still undergoing more widespread compatibility testing now. Also, see bug 958129.

An alternative to taking this patch would be to pull out the security fixes into a special NSS release. However, the problem with doing that is that we wouldn't be running the full suite of NSS tests on that special version of NSS. This adds its own risks. Also, we've not created such special security-fix-only releases of NSS, at least in the last three years, IIRC.

String or UUID changes made by this patch: None.

Comment 65

[Ryan VanderMeulen [:RyanVM]]

Comment on attachment 830023 [details] [diff] [review]
NSS_3_15_4_BETA2-with-configure.in-bump.patch

b2g28 = aurora for this cycle :)

Comment 66

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: NSS 3.15.4 for esr24 (with configure.in bump)

Here's what I did to generate this:

python client.py update_nss NSS_3_15_4_RTM
hg addremove
vi configure.in
hg commit -m "bug 898431 - Update NSS to NSS 3.15.4 (NSS_3_15_4_RTM) r=me a=lsblakk"

There were no patches in security/patches, so nothing needed to be applied after updating NSS (as far as I understand).

Comment 67

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8363126 [details] [diff] [review]
NSS 3.15.4 for esr24 (with configure.in bump)

Review of attachment 8363126 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks. I reviewed only configure.in and the sequence of commands you listed in your comment.

Comment 68

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

https://hg.mozilla.org/releases/mozilla-esr24/rev/82e7b63f3f3e

Comment 69

[Ryan VanderMeulen [:RyanVM]]

The esr24 patch applied cleanly to b2g26, so I went ahead and pushed it there too. That leaves just b2g18 to fix.

https://hg.mozilla.org/releases/mozilla-b2g26_v1_2/rev/80dace8b6ddb

Comment 70

[Ryan VanderMeulen [:RyanVM]]

On b2g18, NSS is carrying local patches for bug 834091 and bug 827543.
* Bug 834091 was fixed in upstream NSS by bug 842856, so that should be OK.
* It appears that bug 826666 was intended to be the upstream solution for bug 827543, but that was eventually WONTFIXed, so vanilla NSS 3.15.4 will be effectively reverting bug 827543. Based on the outcome of bug 826666, I think that's OK as well?

Comment 71

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

As far as I can tell, NSS 3.15.4 does revert bug 827543, but it includes the active distrust of the TURKTRUST certificate that mis-issued the certificates: https://hg.mozilla.org/projects/nss/file/c3565a90b8c4/lib/ckfw/builtins/certdata.txt#l26839 (which was the reason for that bug). So, yes, that should be ok. (See also http://bonsai.mozilla.org/cvsview2.cgi?diff_mode=context&whitespace_mode=show&file=certdata.txt&branch=&root=/cvsroot&subdir=mozilla/security/nss/lib/ckfw/builtins&command=DIFF_FRAMESET&rev1=1.86&rev2=1.87 )

Comment 72

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: NSS 3.15.4 for b2g18 (with configure.in bump)

I generated this by first cherry-picking rev. b20eab2be2dc of client.py from mozilla-central (and putting it in a separate patch - not sure if we want to check it in or what). Then, I followed the same steps as before. I didn't check in the private patches (see the reasoning from Ryan and me, above).
Try was basically useless, so I just ran the xpcshell suite locally. The only tests that failed were ones that fail without the patch.

Comment 73

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Attachment: patch to update client.py to rev. b20eab2be2dc

This is the client.py patch.

Comment 74

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Comment on attachment 8365171 [details] [diff] [review]
NSS 3.15.4 for b2g18 (with configure.in bump)

I wouldn't be surprised if we need to make changes to security/build to deal with the much-newer NSS. The only way to know would be to build and run the tests, which I guess will happen at checkin.

Please check in the client.py update along with this.

Comment 75

[Dana Keeler (she/her) (use needinfo) [:keeler] (on leave)]

Well, here goes:

https://hg.mozilla.org/releases/mozilla-b2g18/rev/14b6b25b481c
https://hg.mozilla.org/releases/mozilla-b2g18/rev/1b24a4178317

Comment 76

[Ryan VanderMeulen [:RyanVM]]

It stuck :)

https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/14b6b25b481c
https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/1b24a4178317