[tor-bugs] #12623 [Tor bundles/installation]: Deploy our TBB update archives on a secure machine

[Tor Bug Tracker & Wiki]

#12623: Deploy our TBB update archives on a secure machine
------------------------------------------+-------------------
     Reporter:  gk                        |      Owner:  erinn
         Type:  task                      |     Status:  new
     Priority:  major                     |  Milestone:
    Component:  Tor bundles/installation  |    Version:
   Resolution:                            |   Keywords:
Actual Points:                            |  Parent ID:  #4234
       Points:                            |
------------------------------------------+-------------------

Comment (by mcs):

 Some of the existing Firefox prefs that we can use are:

 app.update.cert.requireBuiltIn
 app.update.cert.checkAttributes
 app.update.certs.1.issuerName
 app.update.certs.1.commonName

 We should be able to add as many attributes as we want under
 app.update.certs.1. (but brade and I have only tested with issuerName and
 commonName which are the ones that Mozilla uses).

 See:
 prefs: http://mxr.mozilla.org/mozilla-
 esr24/source/browser/app/profile/firefox.js#92

 update manifest onLoad handler: http://mxr.mozilla.org/mozilla-
 esr24/source/toolkit/mozapps/update/nsUpdateService.js#3370

 checkCert from CertUtils.jsm: http://mxr.mozilla.org/mozilla-
 esr24/source/toolkit/modules/CertUtils.jsm#119

 gk -- Do you think these existing mechanisms provide enough flexibility
 for TBB?
 (brade and I think they do)

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/12623#comment:2>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online