Commit e40d782c authored by Kathleen Brade's avatar Kathleen Brade Committed by Georg Koppen
Browse files

Bug 13379: Sign our MAR files. 

Replace Mozilla's MAR signing certificates with our own.
Configure with --enable-signmar (build the signmar tool).
Configure with --enable-verify-mar (when updating, require a valid signature
  on the MAR file before it is applied).
Use the Tor Browser version instead of the Firefox version inside the
  MAR file info block (necessary to prevent downgrade attacks).
Use NSS on all platforms for checking MAR signatures (Mozilla plans to use
  OS-native APIs on Mac OS and they already do so on Windows). So that the
  NSS and NSPR libraries the updater depends on can be found at runtime, we
  add the firefox directory to the shared library search path on all platforms.
Use SHA512-based MAR signatures instead of the SHA1-based ones that Mozilla
  uses. This is implemented inside MAR_USE_SHA512_RSA_SIG #ifdef's and with
  a signature algorithm ID of 512 to help avoid collisions with future work
  Mozilla might do in this area.
  See: https://bugzilla.mozilla.org/show_bug.cgi?id=1105689
parent fe960849

.mozconfig

+2 −1
Original line number Diff line number Diff line
@@ -11,7 +11,8 @@ ac_add_options --enable-official-branding 


ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



ac_add_options --disable-strip

ac_add_options --disable-install-strip

.mozconfig-asan

+2 −1
Original line number Diff line number Diff line
@@ -20,7 +20,8 @@ ac_add_options --enable-official-branding 


ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



ac_add_options --disable-strip

ac_add_options --disable-install-strip

.mozconfig-mac

+2 −1
Original line number Diff line number Diff line
@@ -42,7 +42,8 @@ ac_add_options --disable-debug 


ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



ac_add_options --disable-crashreporter

ac_add_options --disable-maintenance-service

.mozconfig-mingw

+2 −1
Original line number Diff line number Diff line
@@ -15,7 +15,8 @@ ac_add_options --enable-official-branding 


ac_add_options --enable-tor-browser-update

ac_add_options --enable-update-packaging

ac_add_options --disable-verify-mar

ac_add_options --enable-signmar

ac_add_options --enable-verify-mar



# ICU seems still to have cross-compiling issues:

# https://bugzilla.mozilla.org/show_bug.cgi?id=1019744#c19

config/external/nss/Makefile.in

+1 −1
Original line number Diff line number Diff line
@@ -283,11 +283,11 @@ endif 
NSS_DIRS += \

  nss/cmd/lib \

  nss/cmd/shlibsign \

  nss/cmd/certutil \

  $(NULL)



ifdef ENABLE_TESTS

NSS_DIRS += \

  nss/cmd/certutil \

  nss/cmd/pk12util \

  nss/cmd/modutil \

  $(NULL)