michael@0: # This Source Code Form is subject to the terms of the Mozilla Public
michael@0: # License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0: # file, You can obtain one at http://mozilla.org/MPL/2.0/.
michael@0: 
michael@0: # On B2G, we need to remove the trust bits for code signing from all the
michael@0: # built-in CAs, because we are redefining the code signing bit to mean
michael@0: # "is trusted to issue certs that are trusted for signing apps," which none
michael@0: # of the normal built-in CAs are. This is a temporary hack until we can use
michael@0: # libpkix to verify the certificates. (libpkix gives the flexibility we need
michael@0: # to verify certificates using different sets of trust anchors per validation.)
michael@0: #
michael@0: # Whenever we change the B2G app signing trust anchor, we need to manually
michael@0: # update certdata-b2g.txt. To do so:
michael@0: #
michael@0: # 1. replace ./b2g-app-root-cert.der with the new DER-encoded root cert
michael@0: #
michael@0: # 2. In this directory run:
michael@0: #
michael@0: #     PATH=$NSS/bin:$NSS/lib addbuiltin -n "b2g-app-root-cert" -t ",,Cu" \
michael@0: #       < b2g-app-root-cert.der > b2g-certdata.txt
michael@0: #
michael@0: # Then, commit the changes. We don't do this step as part of the build because
michael@0: # we do not build addbuiltin as part of a Gecko build.
michael@0: 
michael@0: # Distrust all existing builtin CAs for code-signing
michael@0: hacked-certdata.txt : $(srcdir)/../nss/lib/ckfw/builtins/certdata.txt
michael@0: 	sed -e "s/^CKA_TRUST_CODE_SIGNING.*CKT_NSS_TRUSTED_DELEGATOR.*/CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST/" \
michael@0: 			$< > $@
michael@0: 
michael@0: combined-certdata.txt : hacked-certdata.txt $(srcdir)/b2g-certdata.txt
michael@0: 	cat $^ > $@
michael@0: 
michael@0: libs-nss/lib libs-nss/lib/ckfw: combined-certdata.txt
michael@0: 
michael@0: DEFAULT_GMAKE_FLAGS += NSS_CERTDATA_TXT='$(CURDIR)/combined-certdata.txt'