The Tor Browser / file comparison
comparison: security/build/b2g-certdata.mk
security/build/b2g-certdata.mk
- branch
- TOR_BUG_9701
- changeset 3
- 141e0f1194b1
equal
deleted
inserted
replaced
| -1:000000000000 | 0:30b60c754b6b |
|---|---|
| 1 # This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 # License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 # file, You can obtain one at http://mozilla.org/MPL/2.0/. | |
| 4 | |
| 5 # On B2G, we need to remove the trust bits for code signing from all the | |
| 6 # built-in CAs, because we are redefining the code signing bit to mean | |
| 7 # "is trusted to issue certs that are trusted for signing apps," which none | |
| 8 # of the normal built-in CAs are. This is a temporary hack until we can use | |
| 9 # libpkix to verify the certificates. (libpkix gives the flexibility we need | |
| 10 # to verify certificates using different sets of trust anchors per validation.) | |
| 11 # | |
| 12 # Whenever we change the B2G app signing trust anchor, we need to manually | |
| 13 # update certdata-b2g.txt. To do so: | |
| 14 # | |
| 15 # 1. replace ./b2g-app-root-cert.der with the new DER-encoded root cert | |
| 16 # | |
| 17 # 2. In this directory run: | |
| 18 # | |
| 19 # PATH=$NSS/bin:$NSS/lib addbuiltin -n "b2g-app-root-cert" -t ",,Cu" \ | |
| 20 # < b2g-app-root-cert.der > b2g-certdata.txt | |
| 21 # | |
| 22 # Then, commit the changes. We don't do this step as part of the build because | |
| 23 # we do not build addbuiltin as part of a Gecko build. | |
| 24 | |
| 25 # Distrust all existing builtin CAs for code-signing | |
| 26 hacked-certdata.txt : $(srcdir)/../nss/lib/ckfw/builtins/certdata.txt | |
| 27 sed -e "s/^CKA_TRUST_CODE_SIGNING.*CKT_NSS_TRUSTED_DELEGATOR.*/CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST/" \ | |
| 28 $< > $@ | |
| 29 | |
| 30 combined-certdata.txt : hacked-certdata.txt $(srcdir)/b2g-certdata.txt | |
| 31 cat $^ > $@ | |
| 32 | |
| 33 libs-nss/lib libs-nss/lib/ckfw: combined-certdata.txt | |
| 34 | |
| 35 DEFAULT_GMAKE_FLAGS += NSS_CERTDATA_TXT='$(CURDIR)/combined-certdata.txt' |
