903135 - Link updater to NSS and enable MAR verification on Linux and OSX

Status: RESOLVED FIXED

(Toolkit :: Application Update, defect)

Comment 1

[Brian R. Bondy [:bbondy]]

This bug is about turning on verification on OSX and Linux (or just everywhere) and using NSS to do the verification.  We should still favor crypto api for verification on Windows.

Comment 2

[Daniel Veditz [:dveditz]]

I don't have any qualms about the security of doing this given existing tests to make sure it actually works.

Comment 3

[Brian R. Bondy [:bbondy]]

Attachment: Bsmith's libmar changes originally from Bug 797477

Comment 4

[Brian R. Bondy [:bbondy]]

Attachment: Build config for verification on all platforms. rev1

Comment 5

[Brian R. Bondy [:bbondy]]

Attachment: Multi platform MAR verification updater code. rev1

Comment 6

[Robert Strong (they/them - no direct email)]

Comment on attachment 789636 [details] [diff] [review]
Multi platform MAR verification updater code. rev1

>diff --git a/toolkit/mozapps/update/updater/updater.cpp b/toolkit/mozapps/update/updater/updater.cpp
>--- a/toolkit/mozapps/update/updater/updater.cpp
>+++ b/toolkit/mozapps/update/updater/updater.cpp
>...
>@@ -2311,16 +2316,30 @@ int NS_main(int argc, NS_tchar **argv)
>     // in the parent process, so we do it here.
>     unsetenv("LD_PRELOAD");
>     execv(argv[0], argv);
>     __android_log_print(ANDROID_LOG_INFO, "updater",
>                         "execve failed: errno: %d. Exiting...", errno);
>     _exit(1);
>   }
> #endif
>+
>+#if defined(MOZ_VERIFY_MAR_SIGNATURE) && !defined(XP_WIN)
>+  // On Windows we rely on CyrptoAPI to do verifications so we don't need to
>+  // initialize NSS at all there.
>+  // Otherwise, minimize the amount of NSS we depend on by avoiding all the NSS
>+  // databases.
>+  if (NSS_NoDB_Init(NULL) != SECSuccess) {
>+   PRErrorCode error = PR_GetError();
>+   fprintf(stderr, "Could not initialize NSS: %s (%d)",
>+           PR_ErrorToName(error), (int) error);
>+    _exit(1);
I suspect it will be a pain but could you change the logging so this error ends up in the log? If so, please submit a new patch for it. Thanks

>+  }
>+#endif
>+
>   InitProgressUI(&argc, &argv);
> 
>   // To process an update the updater command line must at a minimum have the
>   // directory path containing the updater.mar file to process as the first argument
>   // and the directory to apply the update to as the second argument. When the
>   // updater is launched by another process the PID of the parent process should be
>   // provided in the optional third argument and the updater will wait on the parent
>   // process to exit if the value is non-zero and the process is present. This is

Comment 7

[Brian R. Bondy [:bbondy]]

Attachment: bug903135_missingdylibfix.diff

I'll send it through a build config peer after your review.
This fixes the OSX failures on Oak which were caused because nss's dylib file couldn't be found.

Comment 8

[Brian R. Bondy [:bbondy]]

Comment on attachment 8380942 [details] [diff] [review]
bug903135_missingdylibfix.diff

I'm going to look into hard linking these or something because it produces a package that is much larger.

Comment 9

[Brian R. Bondy [:bbondy]]

Comment on attachment 8380942 [details] [diff] [review]
bug903135_missingdylibfix.diff

Obsoleting this since we are using native APIs now and we don't want this dylib files included

Comment 10

[Stephen A Pohl [:spohl]]

Attachment: Part 1: Bsmith's libmar changes originally from Bug 797477

Updated for current trunk. Carrying over r+.

Comment 11

[Stephen A Pohl [:spohl]]

Attachment: Part 2: Build config for verification on all platforms. rev1

Updated for current trunk. Carrying over r+.

Comment 12

[Stephen A Pohl [:spohl]]

Attachment: Part 3: Multi platform MAR verification updater code. rev1

Updated for current trunk. Carrying over r+.

Comment 13

[Brian R. Bondy [:bbondy]]

Attachment: Part 1: Bsmith's libmar changes originally from Bug 797477. rev2

Rebased

Comment 14

[Brian R. Bondy [:bbondy]]

Attachment: Part 2: Build config for verification on all platforms. rev2

Rebased

Comment 15

[Brian R. Bondy [:bbondy]]

Attachment: Part 3: Multi platform MAR verification updater code. rev2

Rebased

Comment 16

[Brian R. Bondy [:bbondy]]

https://hg.mozilla.org/mozilla-central/pushloghtml?changeset=883e17fc475f