Verified Commit 45ae8e47 authored by Kathleen Brade's avatar Kathleen Brade Committed by Pier Angelo Vendrame
Browse files

Bug 13379: Allow using NSS to sign and verify MAR signatures 

Allow using NSS on all platforms for checking MAR signatures (instead
  of using OS-native APIs, the default on Mac OS and Windows).
  So that the NSS and NSPR libraries the updater depends on can be
  found at runtime, we add the firefox directory to the shared library
  search path on macOS.
  On Linux, rpath is used to solve that problem, but that approach
  won't work on macOS because the updater executable is copied during
  the update process to a location that can vary.
parent b7184de0

browser/config/mozconfigs/base-browser

+1 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ ac_add_options --enable-rust-simd 


# Bug 13379: Sign our MAR files.

ac_add_options --enable-verify-mar

ac_add_options --enable-nss-mar



ac_add_options --enable-bundled-fonts

build/moz.configure/update-programs.configure

+8 −0
Original line number Diff line number Diff line
@@ -32,6 +32,14 @@ set_config( 
    "MOZ_VERIFY_MAR_SIGNATURE", depends_if("--enable-verify-mar")(lambda _: True)

)



# Use NSS for MAR signatures even on platforms where system libraries are

# supported (currently Windows and macOS).

# ==============================================================



option("--enable-nss-mar", help="Always use NSS for MAR signatures")



set_config("MOZ_USE_NSS_FOR_MAR", True, when="--enable-nss-mar")



# Maintenance service (Windows only)

# ==============================================================

modules/libmar/tool/mar.c

+3 −3
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ static void print_usage() { 
      "signed_input_archive.mar base_64_encoded_signature_file "

      "changed_signed_output.mar\n");

  printf("(i) is the index of the certificate to extract\n");

#  if defined(XP_MACOSX) || (defined(XP_WIN) && !defined(MAR_NSS))

#  if (defined(XP_MACOSX) || defined(XP_WIN)) && !defined(MAR_NSS)

  printf("Verify a MAR file:\n");

  printf("  mar [-C workingDir] -D DERFilePath -v signed_archive.mar\n");

  printf(
@@ -149,7 +149,7 @@ int main(int argc, char** argv) { 
  memset((void*)certBuffers, 0, sizeof(certBuffers));

#endif

#if !defined(NO_SIGN_VERIFY) && \

    ((!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX))

    (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX)))

  memset(DERFilePaths, 0, sizeof(DERFilePaths));

  memset(fileSizes, 0, sizeof(fileSizes));

#endif
@@ -181,7 +181,7 @@ int main(int argc, char** argv) { 
      argc -= 2;

    }

#if !defined(NO_SIGN_VERIFY)

#  if (!defined(MAR_NSS) && defined(XP_WIN)) || defined(XP_MACOSX)

#  if (!defined(MAR_NSS) && (defined(XP_WIN) || defined(XP_MACOSX)))

    /* -D DERFilePath, also matches -D[index] DERFilePath

       We allow an index for verifying to be symmetric

       with the import and export command line arguments. */

modules/libmar/tool/moz.build

+9 −3
Original line number Diff line number Diff line
@@ -43,15 +43,21 @@ if CONFIG["MOZ_BUILD_APP"] != "tools/update-packaging": 
        "verifymar",

    ]



    if CONFIG["MOZ_USE_NSS_FOR_MAR"]:

        DEFINES["MAR_NSS"] = True



    if CONFIG["OS_ARCH"] == "WINNT":

        USE_STATIC_LIBS = True



        OS_LIBS += [

            "ws2_32",

        ]

        if not CONFIG["MOZ_USE_NSS_FOR_MAR"]:

            OS_LIBS += [

                "crypt32",

                "advapi32",

            ]

    elif CONFIG["OS_ARCH"] == "Darwin":

    elif CONFIG["OS_ARCH"] == "Darwin" and not CONFIG["MOZ_USE_NSS_FOR_MAR"]:

        OS_LIBS += [

            "-framework CoreFoundation",

            "-framework Security",

modules/libmar/verify/moz.build

+16 −10
Original line number Diff line number Diff line
@@ -15,33 +15,39 @@ FORCE_STATIC_LIB = True 


if CONFIG["OS_ARCH"] == "WINNT":

    USE_STATIC_LIBS = True

elif CONFIG["OS_ARCH"] == "Darwin":

    use_nss = CONFIG["MOZ_USE_NSS_FOR_MAR"]

elif CONFIG["OS_ARCH"] == "Darwin" and not CONFIG["MOZ_USE_NSS_FOR_MAR"]:

    UNIFIED_SOURCES += [

        "MacVerifyCrypto.cpp",

    ]

    OS_LIBS += [

        "-framework Security",

    ]

    use_nss = False

else:

    DEFINES["MAR_NSS"] = True

    LOCAL_INCLUDES += ["../sign"]

    USE_LIBS += [

        "nspr",

        "nss",

        "signmar",

    ]

    if CONFIG["OS_ARCH"] != "Darwin":

        # Ideally, this would be '-Wl,-rpath=$ORIGIN', but the build system

        # doesn't do the right escaping yet. Even more ideally, this would

    # be LDFLAGS, but the build system doesn't propagate those like USE_LIBS

    # and OS_LIBS. Bug #1041943.

        # be LDFLAGS, but the build system doesn't propagate those like

        # USE_LIBS and OS_LIBS. Bug #1041943.

        OS_LIBS += [

            "-Wl,-rpath=\\$$ORIGIN",

        ]

    use_nss = True



LOCAL_INCLUDES += [

    "../src",

]



if use_nss:

    LOCAL_INCLUDES += ["../sign"]

    DEFINES["MAR_NSS"] = True



# C11 for static_assert

c11_flags = ["-std=gnu11"]

if CONFIG["CC_TYPE"] == "clang-cl":