CMXSL.org/trisquel-icecat
2
0
Fork 0
Code Issues Pull requests Projects Releases 11 Packages Wiki Activity Actions

icecat: add release icecat-140.10.1-1gnu1 for ecne

Browse source
This commit is contained in:
Ark74 2026-05-04 16:58:41 -06:00
parent a5f93cb214
commit ff85d7c623
1256 changed files with 63469 additions and 24141 deletions
Download patch file Download diff file Expand all files Collapse all files

42
icecat/security/manager/ssl/PSMRunnable.cpp
View file

@ -1,42 +0,0 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#include "PSMRunnable.h"
namespace mozilla {
namespace psm {
SyncRunnableBase::SyncRunnableBase()
: Runnable("psm::SyncRunnableBase"), monitor("SyncRunnableBase::monitor") {}
nsresult SyncRunnableBase::DispatchToMainThreadAndWait() {
nsresult rv;
if (NS_IsMainThread()) {
RunOnTargetThread();
rv = NS_OK;
} else {
mozilla::MonitorAutoLock lock(monitor);
rv = NS_DispatchToMainThread(this);
if (NS_SUCCEEDED(rv)) {
lock.Wait();
}
}
return rv;
}
NS_IMETHODIMP
SyncRunnableBase::Run() {
RunOnTargetThread();
mozilla::MonitorAutoLock(monitor).Notify();
return NS_OK;
}
nsresult NotifyObserverRunnable::Run() {
mObserver->Observe(nullptr, mTopic, nullptr);
return NS_OK;
}
} // namespace psm
} // namespace mozilla

49
icecat/security/manager/ssl/PSMRunnable.h
View file

@ -1,49 +0,0 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
#ifndef PSMRunnable_h
#define PSMRunnable_h
#include "mozilla/Monitor.h"
#include "nsThreadUtils.h"
#include "nsIObserver.h"
#include "nsProxyRelease.h"
namespace mozilla {
namespace psm {
// Wait for the event to run on the target thread without spinning the event
// loop on the calling thread. (Dispatching events to a thread using
// NS_DispatchAndSpinEventLoopUntilComplete would cause the event loop on the
// calling thread to spin.)
class SyncRunnableBase : public Runnable {
public:
NS_DECL_NSIRUNNABLE
nsresult DispatchToMainThreadAndWait();
protected:
SyncRunnableBase();
virtual void RunOnTargetThread() = 0;
private:
mozilla::Monitor monitor MOZ_UNANNOTATED;
};
class NotifyObserverRunnable : public Runnable {
public:
NotifyObserverRunnable(nsIObserver* observer, const char* topicStringLiteral)
: Runnable("psm::NotifyObserverRunnable"),
mObserver(new nsMainThreadPtrHolder<nsIObserver>(
"psm::NotifyObserverRunnable::mObserver", observer)),
mTopic(topicStringLiteral) {}
NS_DECL_NSIRUNNABLE
private:
nsMainThreadPtrHandle<nsIObserver> mObserver;
const char* const mTopic;
};
} // namespace psm
} // namespace mozilla
#endif

1
icecat/security/manager/ssl/SSLServerCertVerification.cpp
View file

@ -99,7 +99,6 @@
#include "ExtendedValidation.h"
#include "NSSCertDBTrustDomain.h"
#include "NSSSocketControl.h"
#include "PSMRunnable.h"
#include "RootCertificateTelemetryUtils.h"
#include "ScopedNSSTypes.h"
#include "SharedCertVerifier.h"

2
icecat/security/manager/ssl/StaticHPKPins.h
View file

@ -726,4 +726,4 @@ static const TransportSecurityPreload kPublicKeyPinningPreloadList[] = {
static const int32_t kUnknownId = -1;
static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1782114773318000);
static const PRTime kPreloadPKPinsExpirationTime = INT64_C(1784533762555000);

7
icecat/security/manager/ssl/moz.build
View file

@ -127,7 +127,6 @@ UNIFIED_SOURCES += [
"nsTLSSocketProvider.cpp",
"OSKeyStore.cpp",
"PKCS11ModuleDB.cpp",
"PSMRunnable.cpp",
"PublicKeyPinningService.cpp",
"RootCertificateTelemetryUtils.cpp",
"SecretDecoderRing.cpp",
@ -192,7 +191,11 @@ if CONFIG["OS_ARCH"] == "WINNT":
"ntdll",
]
UNIFIED_SOURCES += [
# CredentialManagerSecret.cpp includes <windows.h> without WIN32_LEAN_AND_MEAN,
# which pulls in <winsock.h> and conflicts with <winsock2.h> included by other
# files in the same unified translation unit. Compile independently to prevent
# that interference.
SOURCES += [
"CredentialManagerSecret.cpp",
]
# Version string comparison is generally wrong, but by the time it would

37
icecat/security/manager/ssl/nsNSSCallbacks.cpp
View file

@ -7,7 +7,6 @@
#include "nsNSSCallbacks.h"
#include "NSSSocketControl.h"
#include "PSMRunnable.h"
#include "ScopedNSSTypes.h"
#include "SharedCertVerifier.h"
#include "mozilla/ArrayUtils.h"
@ -20,6 +19,7 @@
#include "mozilla/SpinEventLoopUntil.h"
#include "mozilla/StaticPrefs_security.h"
#include "mozilla/Unused.h"
#include "mozilla/SyncRunnable.h"
#include "mozilla/glean/SecurityManagerSslMetrics.h"
#include "mozilla/intl/Localization.h"
#include "nsContentUtils.h"
@ -40,6 +40,7 @@
#include "nsNetUtil.h"
#include "nsProxyRelease.h"
#include "nsStringStream.h"
#include "nsThreadUtils.h"
#include "mozpkix/pkixtypes.h"
#include "ssl.h"
#include "sslproto.h"
@ -546,28 +547,36 @@ static char* ShowProtectedAuthPrompt(PK11SlotInfo* slot, nsIPrompt* prompt) {
}
}
class PK11PasswordPromptRunnable : public SyncRunnableBase {
class PK11PasswordPromptRunnable final : public nsIRunnable {
public:
PK11PasswordPromptRunnable(PK11SlotInfo* slot, nsIInterfaceRequestor* ir)
: mResult(nullptr), mSlot(slot), mIR(ir) {}
virtual ~PK11PasswordPromptRunnable() = default;
NS_DECL_THREADSAFE_ISUPPORTS
NS_DECL_NSIRUNNABLE
char* mResult; // out
virtual void RunOnTargetThread() override;
private:
~PK11PasswordPromptRunnable() = default;
// Accessed only on the main thread. True if any instance of
// PK11PasswordPromptRunnable is already running.
static bool mRunning;
PK11SlotInfo* mSlot;
nsIInterfaceRequestor* mIR;
};
NS_IMPL_ISUPPORTS(PK11PasswordPromptRunnable, nsIRunnable)
bool PK11PasswordPromptRunnable::mRunning = false;
void PK11PasswordPromptRunnable::RunOnTargetThread() {
NS_IMETHODIMP
PK11PasswordPromptRunnable::Run() {
MOZ_ASSERT(NS_IsMainThread());
if (!NS_IsMainThread()) {
return;
return NS_ERROR_NOT_SAME_THREAD;
}
// If we've reentered due to the nested event loop implicit in using
@ -577,7 +586,7 @@ void PK11PasswordPromptRunnable::RunOnTargetThread() {
// to fail, but this is better than littering the screen with a bunch of
// password prompts that the user will probably just cancel anyway.
if (mRunning) {
return;
return NS_OK;
}
mRunning = true;
auto setRunningToFalseOnExit = MakeScopeExit([&]() { mRunning = false; });
@ -587,7 +596,7 @@ void PK11PasswordPromptRunnable::RunOnTargetThread() {
if (!mIR) {
rv = nsNSSComponent::GetNewPrompter(getter_AddRefs(prompt));
if (NS_FAILED(rv)) {
return;
return rv;
}
} else {
prompt = do_GetInterface(mIR);
@ -595,12 +604,12 @@ void PK11PasswordPromptRunnable::RunOnTargetThread() {
}
if (!prompt) {
return;
return NS_ERROR_FAILURE;
}
if (PK11_ProtectedAuthenticationPath(mSlot)) {
mResult = ShowProtectedAuthPrompt(mSlot, prompt);
return;
return NS_OK;
}
nsAutoString promptString;
@ -613,7 +622,7 @@ void PK11PasswordPromptRunnable::RunOnTargetThread() {
promptString);
}
if (NS_FAILED(rv)) {
return;
return rv;
}
nsString password;
@ -621,10 +630,11 @@ void PK11PasswordPromptRunnable::RunOnTargetThread() {
rv = prompt->PromptPassword(nullptr, promptString.get(),
getter_Copies(password), &userClickedOK);
if (NS_FAILED(rv) || !userClickedOK) {
return;
return rv;
}
mResult = ToNewUTF8String(password);
return NS_OK;
}
char* PK11PasswordPrompt(PK11SlotInfo* slot, PRBool /*retry*/, void* arg) {
@ -633,7 +643,8 @@ char* PK11PasswordPrompt(PK11SlotInfo* slot, PRBool /*retry*/, void* arg) {
}
RefPtr<PK11PasswordPromptRunnable> runnable(new PK11PasswordPromptRunnable(
slot, static_cast<nsIInterfaceRequestor*>(arg)));
runnable->DispatchToMainThreadAndWait();
MOZ_ALWAYS_SUCCEEDS(SyncRunnable::DispatchToThread(
GetMainThreadSerialEventTarget(), runnable));
return runnable->mResult;
}

1
icecat/security/manager/ssl/nsNSSIOLayer.cpp
View file

@ -13,7 +13,6 @@
#include "NSSCertDBTrustDomain.h"
#include "NSSErrorsService.h"
#include "NSSSocketControl.h"
#include "PSMRunnable.h"
#include "SSLServerCertVerification.h"
#include "ScopedNSSTypes.h"
#include "TLSClientAuthCertSelection.h"

4378
icecat/security/manager/ssl/nsSTSPreloadList.inc
View file

File diff suppressed because it is too large Load diff

21
icecat/security/manager/tools/PreloadedHPKPins.json
View file

@ -26,23 +26,19 @@
{
"chromium_data" : {
"cert_file_url": "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static.pins?format=TEXT",
"json_file_url": "https://chromium.googlesource.com/chromium/src/+/refs/heads/main/net/http/transport_security_state_static_pins.json?format=TEXT",
"cert_file_url": "https://raw.githubusercontent.com/chromium/chromium/refs/heads/main/net/http/transport_security_state_static.pins",
"json_file_url": "https://raw.githubusercontent.com/chromium/chromium/refs/heads/main/net/http/transport_security_state_static_pins.json",
"substitute_pinsets": {
// Use the larger google_root_pems pinset instead of google
"google": "google_root_pems"
},
"production_pinsets": [
"google_root_pems",
"facebook",
"ncsccs"
"google_root_pems"
],
"production_domains": [
// Chrome's test domains.
"pinningtest.appspot.com",
"pinning-test.badssl.com",
// SpiderOak
"spideroak.com"
"pinning-test.badssl.com"
],
"exclude_domains" : []
},
@ -85,11 +81,6 @@
{
"name": "google_root_pems",
"sha256_hashes": [
"AffirmTrust Commercial",
"AffirmTrust Networking",
"AffirmTrust Premium",
"AffirmTrust Premium ECC",
"Baltimore CyberTrust Root",
"Comodo AAA Services root",
"COMODO Certification Authority",
"COMODO ECC Certification Authority",
@ -102,10 +93,6 @@
"DigiCert Global Root G3",
"DigiCert High Assurance EV Root CA",
"DigiCert Trusted Root G4",
"Entrust Root Certification Authority",
"Entrust Root Certification Authority - EC1",
"Entrust Root Certification Authority - G2",
"Entrust.net Premium 2048 Secure Server CA",
"GlobalSign ECC Root CA - R4",
"GlobalSign ECC Root CA - R5",
"GlobalSign Root CA",

4
icecat/security/manager/tools/log_list.json
View file

@ -1,6 +1,6 @@
{
"version": "85.16",
"log_list_timestamp": "2026-03-15T13:34:00Z",
"version": "85.43",
"log_list_timestamp": "2026-04-12T13:36:12Z",
"operators": [
{
"name": "Google",