per https://bugzilla.mozilla.org/show_bug.cgi?id=1525191#c6 .

Depends on D101697

Differential Revision: https://phabricator.services.mozilla.com/D101698

Differential Revision: https://phabricator.services.mozilla.com/D59380

--HG--
extra : moz-landing-system : lando

--HG--
extra : histedit_source : 6ce02641a71fb5a2d704620d003c23bb8709f49b

Summary:
Scripts:
https://gist.github.com/jcjones/b25e07de3a48c3ed084f0f9e26911693

# From the above gist
./jcj-regenerate-certspecs

# This is a DER form, not a PEM.
openssl x509 -in security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem -outform der > security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.der
rm security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem

# These don't seem to be checked in
rm services/common/tests/unit/test_blocklist_signatures/*.pem

Reviewers: ccoroiu

Bug #: 1525191

Differential Revision: https://phabricator.services.mozilla.com/D18638

--HG--
extra : histedit_source : f6e29ef6f3d012e42cda980abbb13bc4276702d6

Bug 1435644: Regenerate the security/manager/ssl test certificates and keys. r=franziskus a=Aryx on a CLOSED TREE

For this, I've uncommented the relevant bits in moz.build files, then:

  ./mach build security/manager
  for dir in $(rg GeneratedTestCertificate | grep security | cut -d : -f 1); do
    cp obj-x86_64-pc-linux-gnu/$(dirname $dir)/*.pem $(dirname $dir);
  done

And same with GeneratedTestKey / *.key

MozReview-Commit-ID: C2bkSo6YYCU

--HG--
extra : amend_source : b59d21b695544a1a4b6c45ba9c00c40f8ceb0f1a

Also regenerate the test_signed_app.js testcases.

MozReview-Commit-ID: 483uNQT0wuG

--HG--
extra : rebase_source : 4dfddf89d151dceb970a1a9139a5c90e6b578f8c

bug 1332131 - regenerate psm xpcshell test certificates to avoid failures when they expire r=Cykesiopka

MozReview-Commit-ID: 5rzoVC6fpRO

--HG--
extra : rebase_source : 23d67dd9de7473db29d2e85f1c30aa4174ae8a8c

nsIX509Cert provided the APIs getUsagesArray, requestUsagesArrayAsync, and
getUsagesString. These APIs were problematic in that the synchronous ones would
cause certificate verification to block the main thread and the asynchronous one
was needlessly indirect in its definition (it made use of two additional
special-case xpidl types) and needlessly complex in its implementation (it
required nsNSSComponent to manually manage a background thread without the aid
of recent improvements in that area (e.g. CryptoTask)). Furthermore, these APIs
would return string descriptions of the usages the certificate in question had
been verified for rather than using more concrete identifiers or values. This
paradigm is usable but imprecise. The new nsIX509CertDB API
asyncVerifyCertAtTime is much more expressive, enforces off-main-thread
computation, and makes use of CryptoTask for a simple implementation. Using this
API, previous uses of the old nsIX509Cert APIs can be replaced. As an additional
benefit, this removes a ton of obsolete C++ code.

MozReview-Commit-ID: KXVTcjAKehu

--HG--
extra : rebase_source : 50c51f73b2b61ed0ad4dc9702cc5df470ce998bc

Differential Revision: https://phabricator.services.mozilla.com/D59380

--HG--
extra : source : 5122f6139ba6d671348f040f16b4c8c99cd2260a

Differential Revision: https://phabricator.services.mozilla.com/D59380

--HG--
extra : source : 5122f6139ba6d671348f040f16b4c8c99cd2260a
extra : intermediate-source : f8722cd456d9ee7f646ccdd048dd93a1476fd507

--HG--
extra : source : 66ff28da3e7dc05eea28a9b2178ee38ab0637df2

Bug 1525191 - Regenerate all .pem.certspec files into their .pems r=try a=try,timebomb-fix CLOSED TREE

Summary:
Scripts:
https://gist.github.com/jcjones/b25e07de3a48c3ed084f0f9e26911693

# From the above gist
./jcj-regenerate-certspecs

# This is a DER form, not a PEM.
openssl x509 -in security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem -outform der > security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.der
rm security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem

# These don't seem to be checked in
rm services/common/tests/unit/test_blocklist_signatures/*.pem

Reviewers: ccoroiu

Bug #: 1525191

Differential Revision: https://phabricator.services.mozilla.com/D18638

--HG--
extra : source : b6ec07118c7058cbd2eaf9b7aa741528b1650047

For this, I've uncommented the relevant bits in moz.build files, then:

  ./mach build security/manager
  for dir in $(rg GeneratedTestCertificate | grep security | cut -d : -f 1); do
    cp obj-x86_64-pc-linux-gnu/$(dirname $dir)/*.pem $(dirname $dir);
  done

And same with GeneratedTestKey / *.key

MozReview-Commit-ID: C2bkSo6YYCU

--HG--
extra : source : 95fd9deac911b5bb667d8750c9669822d68b80fc

Bug 1332131 - Regenerate psm xpcshell test certificates to avoid failures when they expire. r=Cykesiopka, a=test-only

MozReview-Commit-ID: 5rzoVC6fpRO

--HG--
extra : rebase_source : cb0416371e513a875078889785c5217fa4b944d5
extra : source : d15f6cbb443d1979bff7d2e974448b6bb3dedcd9
extra : histedit_source : 3c9b031ed1291fccf22ac0a27c9bb9f46f56c609

--HG--
extra : source : 66ff28da3e7dc05eea28a9b2178ee38ab0637df2
extra : intermediate-source : da5d5c54fd8917ea488e4cdb741a91285d0e4c80

Bug 1525191 - Regenerate all .pem.certspec files into their .pems r=try a=try,timebomb-fix CLOSED TREE

Summary:
Scripts:
https://gist.github.com/jcjones/b25e07de3a48c3ed084f0f9e26911693

# From the above gist
./jcj-regenerate-certspecs

# This is a DER form, not a PEM.
openssl x509 -in security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem -outform der > security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.der
rm security/manager/ssl/tests/unit/test_signed_apps/xpcshellTestRoot.pem

# These don't seem to be checked in
rm services/common/tests/unit/test_blocklist_signatures/*.pem

Reviewers: ccoroiu

Bug #: 1525191

Differential Revision: https://phabricator.services.mozilla.com/D18638

--HG--
extra : source : b6ec07118c7058cbd2eaf9b7aa741528b1650047
extra : intermediate-source : e3f0663bac742332ee5d2dace75a190c4480284a

Bug 1435644 - Regenerate the security/manager/ssl test certificates and keys. r=franziskus, a=test-only

For this, I've uncommented the relevant bits in moz.build files, then:

  ./mach build security/manager
  for dir in $(rg GeneratedTestCertificate | grep security | cut -d : -f 1); do
    cp obj-x86_64-pc-linux-gnu/$(dirname $dir)/*.pem $(dirname $dir);
  done

And same with GeneratedTestKey / *.key. Also regenerate the signed apps and metadata for tests expecting specific dates.

MozReview-Commit-ID: C2bkSo6YYCU

--HG--
extra : source : 95fd9deac911b5bb667d8750c9669822d68b80fc
extra : intermediate-source : 87c5dfa3fc645fab244a4dd294b0ba6c128ca7b9
extra : histedit_source : e473910425d1832523c97d151ed55467211f0ad6%2Cae2e623cfdb062b5347612f8011bd6d36b036288

Also regenerate the test_signed_app.js testcases.

MozReview-Commit-ID: 483uNQT0wuG

--HG--
extra : source : e972f1bffe6982813442ad3cb6d59571fa85000f
extra : histedit_source : 63fffad6585100ace042febd10c7b534e2c3523f

Bug 1332131 - Regenerate psm xpcshell test certificates to avoid failures when they expire. r=Cykesiopka, a=test-only

MozReview-Commit-ID: 5rzoVC6fpRO

--HG--
extra : source : d15f6cbb443d1979bff7d2e974448b6bb3dedcd9
extra : intermediate-source : 537e167ee9d227e997397dd487d2da734f1ba523