tools: fix updating root certificates

richardlau · targos · commit b8927ddf1611 · 2023-05-02T09:34:01.000+02:00
When searching for the latest certdata.txt, check that the file exists on the remote server. PR-URL: #47607 Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
diff --git a/tools/dep_updaters/update-root-certs.mjs b/tools/dep_updaters/update-root-certs.mjs
@@ -22,6 +22,12 @@ const formatDate = (d) => {
 return iso.substring(0, iso.indexOf('T'));
 };
 
+const getCertdataURL = (version) => {
+ const tag = `NSS_${version.replaceAll('.', '_')}_RTM`;
+ const certdataURL = `https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`;
+ return certdataURL;
+};
+
 const normalizeTD = (text) => {
 // Remove whitespace and any HTML tags.
 return text?.trim().replace(/<.*?>/g, '');
@@ -74,22 +80,33 @@ const getReleases = (text) => {
 return releases;
 };
 
-const getLatestVersion = (releases) => {
- const arrayNumberSort = (x, y, i) => {
+const getLatestVersion = async (releases) => {
+ const arrayNumberSortDescending = (x, y, i) => {
 if (x[i] === undefined && y[i] === undefined) {
 return 0;
 } else if (x[i] === y[i]) {
- return arrayNumberSort(x, y, i + 1);
+ return arrayNumberSortDescending(x, y, i + 1);
 }
- return (x[i] ?? 0) - (y[i] ?? 0);
+ return (y[i] ?? 0) - (x[i] ?? 0);
 };
 const extractVersion = (t) => {
 return t[kNSSVersion].split('.').map((n) => parseInt(n));
 };
 const releaseSorter = (x, y) => {
- return arrayNumberSort(extractVersion(x), extractVersion(y), 0);
+ return arrayNumberSortDescending(extractVersion(x), extractVersion(y), 0);
 };
- return releases.sort(releaseSorter).filter(pastRelease).at(-1)[kNSSVersion];
+ // Return the most recent certadata.txt that exists on the server.
+ const sortedReleases = releases.sort(releaseSorter).filter(pastRelease);
+ for (const candidate of sortedReleases) {
+ const candidateURL = getCertdataURL(candidate[kNSSVersion]);
+ if (values.verbose) {
+ console.log(`Trying ${candidateURL}`);
+ }
+ const response = await fetch(candidateURL, { method: 'HEAD' });
+ if (response.ok) {
+ return candidate[kNSSVersion];
+ }
+ }
 };
 
 const pastRelease = (r) => {
@@ -129,10 +146,10 @@ if (values.help) {
 process.exit(0);
 }
 
+const scheduleURL = 'https://wiki.mozilla.org/NSS:Release_Versions';
 if (values.verbose) {
- console.log('Fetching NSS release schedule');
+ console.log(`Fetching NSS release schedule from ${scheduleURL}`);
 }
-const scheduleURL = 'https://wiki.mozilla.org/NSS:Release_Versions';
 const schedule = await fetch(scheduleURL);
 if (!schedule.ok) {
 console.error(`Failed to fetch ${scheduleURL}: ${schedule.status}: ${schedule.statusText}`);
@@ -142,7 +159,7 @@ const scheduleText = await schedule.text();
 const nssReleases = getReleases(scheduleText);
 
 // Retrieve metadata for the NSS release being updated to.
-const version = positionals[0] ?? getLatestVersion(nssReleases);
+const version = positionals[0] ?? await getLatestVersion(nssReleases);
 const release = nssReleases.find((r) => {
 return new RegExp(`^${version.replace('.', '\\.')}\\b`).test(r[kNSSVersion]);
 });
@@ -155,8 +172,7 @@ if (values.verbose) {
 }
 
 // Fetch certdata.txt and overwrite the local copy.
-const tag = `NSS_${version.replaceAll('.', '_')}_RTM`;
-const certdataURL = `https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`;
+const certdataURL = getCertdataURL(version);
 if (values.verbose) {
 console.log(`Fetching ${certdataURL}`);
 }

-Original file line number
+Diff line change
 returniso.substring(0,iso.indexOf('T'));
 };
 +constgetCertdataURL=(version)=>{
 +consttag=`NSS_${version.replaceAll('.','_')}_RTM`;
 +constcertdataURL=`https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`;
 +returncertdataURL;
 +};
++
 constnormalizeTD=(text)=>{
 // Remove whitespace and any HTML tags.
 returntext?.trim().replace(/<.*?>/g,'');
 returnreleases;
 };
 -constgetLatestVersion=(releases)=>{
 -constarrayNumberSort=(x,y,i)=>{
 +constgetLatestVersion=async(releases)=>{
 +constarrayNumberSortDescending=(x,y,i)=>{
 if(x[i]===undefined&&y[i]===undefined){
 return0;
 }elseif(x[i]===y[i]){
 -returnarrayNumberSort(x,y,i+1);
 +returnarrayNumberSortDescending(x,y,i+1);
+}
 -return(x[i]??0)-(y[i]??0);
 +return(y[i]??0)-(x[i]??0);
 };
 constextractVersion=(t)=>{
 returnt[kNSSVersion].split('.').map((n)=>parseInt(n));
 };
 constreleaseSorter=(x,y)=>{
 -returnarrayNumberSort(extractVersion(x),extractVersion(y),0);
 +returnarrayNumberSortDescending(extractVersion(x),extractVersion(y),0);
 };
 -returnreleases.sort(releaseSorter).filter(pastRelease).at(-1)[kNSSVersion];
 +// Return the most recent certadata.txt that exists on the server.
 +constsortedReleases=releases.sort(releaseSorter).filter(pastRelease);
 +for(constcandidateofsortedReleases){
 +constcandidateURL=getCertdataURL(candidate[kNSSVersion]);
 +if(values.verbose){
 +console.log(`Trying ${candidateURL}`);
 +}
 +constresponse=awaitfetch(candidateURL,{method: 'HEAD'});
 +if(response.ok){
 +returncandidate[kNSSVersion];
 +}
 +}
 };
 constpastRelease=(r)=>{
 process.exit(0);
+}
 +constscheduleURL='https://wiki.mozilla.org/NSS:Release_Versions';
 if(values.verbose){
 -console.log('Fetching NSS release schedule');
 +console.log(`Fetching NSS release schedule from ${scheduleURL}`);
+}
 -constscheduleURL='https://wiki.mozilla.org/NSS:Release_Versions';
 constschedule=awaitfetch(scheduleURL);
 if(!schedule.ok){
 console.error(`Failed to fetch ${scheduleURL}: ${schedule.status}: ${schedule.statusText}`);
 constnssReleases=getReleases(scheduleText);
 // Retrieve metadata for the NSS release being updated to.
 -constversion=positionals[0]??getLatestVersion(nssReleases);
 +constversion=positionals[0]??awaitgetLatestVersion(nssReleases);
 constrelease=nssReleases.find((r)=>{
 returnnewRegExp(`^${version.replace('.','\\.')}\\b`).test(r[kNSSVersion]);
 });
+}
 // Fetch certdata.txt and overwrite the local copy.
 -consttag=`NSS_${version.replaceAll('.','_')}_RTM`;
 -constcertdataURL=`https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`;
 +constcertdataURL=getCertdataURL(version);
 if(values.verbose){
 console.log(`Fetching ${certdataURL}`);
+}