918629 - Create Gecko-independent embeddable, scriptable, certificate verification library

Status: RESOLVED WONTFIX

(Core :: Security: PSM, defect, P2)

Description

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

+++ This bug was initially created as a clone of Bug #891066 +++

Bug 891066 is the prerequisite refactoring of PSM to make it possible to create the EmbeddedCertVerifier library. This bug is about actually creating the EmbeddedCertVerifier library.

For various reasons we need to be able to build the certificate verification part of Gecko separately from the rest of Gecko.

On #developers, some of us discussed whether we should really modify the Mozilla build system to accommodate this, or whether we should just have people issue specific "./mach build <directory>" commands, or whether we should just have people build NSPR and NSS standalone and then build CertVerifier. However, only the first option (modifying the build system to accomodate building CertVerifier as a subset of libxul) seems acceptable to me, because a big part of the project is to get the configuration of NSPR, NSS, and CertVerifier to *exactly* match how they are built, without requiring people using it to do (half-)hour long builds of libxul. I have made my build system changes as unobtrusive as possible to facilitate this.

Comment 1

[Brian Smith (:briansmith, :bsmith, use NEEDINFO?)]

Nobody is ever going to do this.