SourceMage Grimoire Bug List

[bugzilla-daemon AT bugs.sourcemage.org]

http://bugs.sourcemage.org/show_bug.cgi?id=9208


jblosser-smgl AT firinn.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         AssignedTo|jblosser-smgl AT firinn.org    |sm-grimoire-
                   |                            |bugs AT lists.ibiblio.org




------- Additional Comments From josebernardo1 AT yahoo.com  2005-07-16 16:57 
-------
fwiw, I see this problem too.

-- 


------- Additional Comments From sergey AT sourcemage.org  2005-07-19 12:54 
-------
The certificates appear to be in NSS's source in file cert7.db. However, this
file is in `tests' high-level directory, and I can't find `make install'
instructions for it so far. I'll figure it out, but if someone has 
pre-NSPR/NSS
separation Firefox or Mozilla, please do "gaze install firefox | grep
'cert?.db'" and let me know where this file is. Assuming it's there :-). 
Thanks!

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-19 15:28 
-------
I don't think that's quite the grep you meant, but no, it isn't there.  'gaze
install firefox | grep cert' only even comes back with:

/usr/include/firefox/nss/cert.h
/usr/include/firefox/nss/certdb.h
/usr/include/firefox/nss/certt.h


-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-19 15:36 
-------
It looks like the file libnssckbi.so may contain the certs after the build. 
This file is installed by both old firefox and nss.  'strings' output on this
file is rather interesting.  Perhaps we have them installed and just aren't
configuring nss to use them?

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-19 15:48 
-------
Ok, doing 'ln -s /usr/lib/libnssckbi.so /usr/lib/firefox/.' got firefox the 
certs.

I have no idea if this is a good idea or not, but it seems to be working.  I 
can
browse my bank/etc. SSL sites without warnings.

So, NSS installs them still, we just have to get firefox to use that file OR 
do
this link, I guess.

-- 


------- Additional Comments From seth AT swoolley.homeip.net  2005-07-19 21:51 
-------
This seems like an excellent way to do it.

Just use persistence defaulting to yes and have at it.


-- 


------- Additional Comments From sergey AT sourcemage.org  2005-07-19 23:25 
-------
I found an indirect confirmation that that's the module we're looking for, 
here:
http://www.mozilla.org/projects/security/pki/nss/loadable_certs.html
Indirect because it's for earlier version of NSS (3.1) and because the library
name is prefixed differently.

-- 


------- Additional Comments From sergey AT sourcemage.org  2005-07-19 23:31 
-------
OK, this is the direct confirmation:
http://www.mozilla.org/projects/security/pki/nss/intro.html

Is it possible not to make a link by adding /usr/lib to /usr/bin/firefox 
script?

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-19 23:52 
-------
(In reply to comment #14)
> OK, this is the direct confirmation:
> http://www.mozilla.org/projects/security/pki/nss/intro.html

And that says "these are standalone loadable modules, not meant to be linked
with directly", so we should be safe doing the symlink

> Is it possible not to make a link by adding /usr/lib to /usr/bin/firefox 
> script?

As far as I can tell, no.  Since nothing actually links to it, the browser 
must
just be looking for it by name in the directory it's running the binary from.


-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-20 00:00 
-------
Found confirmation it's based on the location of {browser}-bin.  See:

https://bugzilla.mozilla.org/show_bug.cgi?id=190394

https://bugzilla.mozilla.org/show_bug.cgi?id=128290

That also references looking in "the GRE", I don't know what that is.

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-20 04:00 
-------
updating summary, this affects at least mozilla as well (and galeon, by way of
mozilla)

-- 


------- Additional Comments From eric AT sandall.us  2005-07-20 17:07 -------
We probably don't want to not update to 1.0.5/1.0.6 in stable-rc/0.1 as 1.0.5 
is
a security update[0] and 1.0.6 is a stability update[1] to 1.0.5.

[0] 
http://www.mozilla.org/projects/security/known-vulnerabilities.html#Firefox
[1] http://www.mozilla.org/products/firefox/releases/1.0.6.html

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-20 17:22 
-------
Yeah, I cleared the 1.0.6 update with swoolley last night.

I'm going to try to get this taken care of today.

-- 


------- Additional Comments From eric AT sandall.us  2005-07-20 17:58 -------
This nss fix will also have to go to stable-rc/0.1 and stable/0.0 for the new
firefox, and if it does then nspr, mozilla, and thunderbird (1.0.6 preferably)
will also have to be pulled in.

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-20 19:25 
-------
As far as I can tell the nss and nspr spells are already the same in stable-rc
and test, so there's nothing to pull in there.  I'm not changing those.  I'm
changing firefox and mozilla to both query if the user wants to include the 
root
certs if they're using nss and if so create the symlink.  I think the thought 
is
that stable-rc is ready to go to stable as soon as this is fixed, so I don't
know that we need to push these all to stable separately.

Thunderbird is not related to this NSS bug, so it should get handled 
separately.

-- 


------- Additional Comments From eric AT sandall.us  2005-07-20 23:28 -------
thunderbird uses nss for SSL certificate authenticity just as firefox and
mozilla do.

So it sounds like just firefox, mozilla, and thunderbird need this fix and 
then
pulled into stable-rc/0.1.

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-21 01:32 
-------
Trying to get a patched firefox 1.0.6 built now, whenever that finishes and
works I'll do the others and then ask people to test them all since they take
forever to build (not that these are really compile-affecting changes from us,
but they are version changes from the vendor).

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-21 01:46 
-------
Actually, I just thought of a possibly better way to handle the configuration 
for this.  Instead of asking in each client spell if they want the root 
certs, how about if we ask in nss.  If they say yes we do nothing special, if 
they say no we remove the libnssckbi.so file.  Then in 
firefox/mozilla/thunderbird we just check if 
$INSTALL_ROOT/usr/lib/libnssckbi.so exists and link to it if it does.  This 
should take care of it all one place.

This would require a little more testing but seems cleaner.

-- 


------- Additional Comments From eric AT sandall.us  2005-07-21 05:51 -------
Makes it cleaner, but removes the per-spell configurability. I'm fine with
either method. :)

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-21 06:20 
-------
I suspect people that require per-spell inclusion or exclusion of the root CA
certs can probably just remove the symlink themselves.

firefox/thunderbird/mozilla are patched.  I'll work on NSS next, but that 
spell
has changes in devel not in test, so anything changed there probably shouldn't
get integrated yet.  However, I don't think we need to wait on that to push 
the
other 3 to stable-rc/stable.  The default behaviour without that change will 
be
the current default, so I don't think that config option is critical for the 
0.1
release.

I'll ask the ML for some testing of these and then they should be able to 
go...

-- 


------- Additional Comments From sergey AT sourcemage.org  2005-07-21 21:50 
-------
Thanks Jeremy for getting to the bottom of this! I'm recasting Firefox and
Thunderbird today to try the fix.

BTW, in regards to comment 26, what is it that you want to do with NSS?

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-21 21:52 
-------
This is in stable-rc, marking it fixed.  I'll create another bug for the NSS 
option.

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-21 22:02 
-------
New bug is bug 9316

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2005-07-24 02:38 
-------
fix is in stable, closing

-- 


------- Additional Comments From jblosser-smgl AT firinn.org  2007-04-01 00:11 
-------
reassign to sm-grimoire-bugs

-- 
Configure bugmail: http://bugs.sourcemage.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.