tools: fix root certificate updater

Determine the NSS version from actual Firefox releases, instead of
attempting to parse a wiki page (which is sensitive to formatting
changes and relies on the page being up to date).
PR-URL: #55681
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>

Author: richardlau

tools/dep_updaters/update-root-certs.mjs

@@ -8,109 +8,78 @@ import { pipeline } from 'node:stream/promises';
 import{fileURLToPath}from'node:url';
 import{parseArgs}from'node:util';
 
-// Constants for NSS release metadata.
-constkNSSVersion='version';
-constkNSSDate='date';
-constkFirefoxVersion='firefoxVersion';
-constkFirefoxDate='firefoxDate';
-
 const__filename=fileURLToPath(import.meta.url);
-constnow=newDate();
-
-constformatDate=(d)=>{
-constiso=d.toISOString();
-returniso.substring(0,iso.indexOf('T'));
-};
 
 constgetCertdataURL=(version)=>{
 consttag=`NSS_${version.replaceAll('.','_')}_RTM`;
-constcertdataURL=`https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`;
+constcertdataURL=`https://raw.githubusercontent.com/nss-dev/nss/refs/tags/${tag}/lib/ckfw/builtins/certdata.txt`;
 returncertdataURL;
 };
 
-constnormalizeTD=(text='')=>{
-// Remove whitespace and any HTML tags.
-returntext?.trim().replace(/<.*?>/g,'');
-};
-constgetReleases=(text)=>{
-constreleases=[];
-consttableRE=/<table[^>]+>([\S\s]*?)<\/table>/g;
-consttableRowRE=/<tr?[^>]*>([\S\s]*?)<\/tr>/g;
-consttableHeaderRE=/<th?[^>]*>([\S\s]*?)<\/th>/g;
-consttableDataRE=/<td?[^>]*>([\S\s]*?)<\/td>/g;
-for(consttableoftext.matchAll(tableRE)){
-constcolumns={};
-constmatches=table[1].matchAll(tableRowRE);
-// First row has the table header.
-letrow=matches.next();
-if(row.done){
-continue;
-}
-constheaders=Array.from(row.value[1].matchAll(tableHeaderRE),(m)=>m[1]);
-if(headers.length>0){
-for(leti=0;i<headers.length;i++){
-if(/NSSversion/i.test(headers[i])){
-columns[kNSSVersion]=i;
-}elseif(/Release.*frombranch/i.test(headers[i])){
-columns[kNSSDate]=i;
-}elseif(/Firefoxversion/i.test(headers[i])){
-columns[kFirefoxVersion]=i;
-}elseif(/Firefoxreleasedate/i.test(headers[i])){
-columns[kFirefoxDate]=i;
-}
-}
-}
-// Filter out "NSS Certificate bugs" table.
-if(columns[kNSSDate]===undefined){
-continue;
-}
-// Scrape releases.
-row=matches.next();
-while(!row.done){
-constcells=Array.from(row.value[1].matchAll(tableDataRE),(m)=>m[1]);
-constrelease={};
-release[kNSSVersion]=normalizeTD(cells[columns[kNSSVersion]]);
-release[kNSSDate]=newDate(normalizeTD(cells[columns[kNSSDate]]));
-release[kFirefoxVersion]=normalizeTD(cells[columns[kFirefoxVersion]]);
-release[kFirefoxDate]=newDate(normalizeTD(cells[columns[kFirefoxDate]]));
-releases.push(release);
-row=matches.next();
-}
+constgetFirefoxReleases=async(everything=false)=>{
+constreleaseDataURL=`https://nucleus.mozilla.org/rna/all-releases.json${everything ? '?all=true' : ''}`;
+if(values.verbose){
+console.log(`Fetching Firefox release data from ${releaseDataURL}.`);
+}
+constreleaseData=awaitfetch(releaseDataURL);
+if(!releaseData.ok){
+console.error(`Failed to fetch ${releaseDataURL}: ${releaseData.status}: ${releaseData.statusText}.`);
+process.exit(-1);
 }
-returnreleases;
+return(awaitreleaseData.json()).filter((release)=>{
+// We're only interested in public releases of Firefox.
+return(release.product==='Firefox'&&release.channel==='Release'&&release.is_public===true);
+}).sort((a,b)=>{
+// Sort results by release date.
+returnnewDate(b.release_date)-newDate(a.release_date);
+});
 };
 
-constgetLatestVersion=async(releases)=>{
-constarrayNumberSortDescending=(x,y,i)=>{
-if(x[i]===undefined&&y[i]===undefined){
-return0;
-}elseif(x[i]===y[i]){
-returnarrayNumberSortDescending(x,y,i+1);
-}
-return(y[i]??0)-(x[i]??0);
-};
-constextractVersion=(t)=>{
-returnt[kNSSVersion].split('.').map((n)=>parseInt(n));
-};
-constreleaseSorter=(x,y)=>{
-returnarrayNumberSortDescending(extractVersion(x),extractVersion(y),0);
-};
-// Return the most recent certadata.txt that exists on the server.
-constsortedReleases=releases.sort(releaseSorter).filter(pastRelease);
-for(constcandidateofsortedReleases){
-constcandidateURL=getCertdataURL(candidate[kNSSVersion]);
-if(values.verbose){
-console.log(`Trying ${candidateURL}`);
+constgetFirefoxRelease=async(version)=>{
+letreleases=awaitgetFirefoxReleases();
+letfound;
+if(version===undefined){
+// No version specified. Find the most recent.
+if(releases.length>0){
+found=releases[0];
+}else{
+if(values.verbose){
+console.log('Unable to find release data for Firefox. Searching full release data.');
+}
+releases=awaitgetFirefoxReleases(true);
+found=releases[0];
 }
-constresponse=awaitfetch(candidateURL,{method: 'HEAD'});
-if(response.ok){
-returncandidate[kNSSVersion];
+}else{
+// Search for the specified release.
+found=releases.find((release)=>release.version===version);
+if(found===undefined){
+if(values.verbose){
+console.log(`Unable to find release data for Firefox ${version}. Searching full release data.`);
+}
+releases=awaitgetFirefoxReleases(true);
+found=releases.find((release)=>release.version===version);
 }
 }
+returnfound;
 };
 
-constpastRelease=(r)=>{
-returnr[kNSSDate]<now;
+constgetNSSVersion=async(release)=>{
+constlatestFirefox=release.version;
+constfirefoxTag=`FIREFOX_${latestFirefox.replace('.','_')}_RELEASE`;
+consttagInfoURL=`https://hg.mozilla.org/releases/mozilla-release/raw-file/${firefoxTag}/security/nss/TAG-INFO`;
+if(values.verbose){
+console.log(`Fetching NSS tag from ${tagInfoURL}.`);
+}
+consttagInfo=awaitfetch(tagInfoURL);
+if(!tagInfo.ok){
+console.error(`Failed to fetch ${tagInfoURL}: ${tagInfo.status}: ${tagInfo.statusText}`);
+}
+consttag=awaittagInfo.text();
+if(values.verbose){
+console.log(`Found tag ${tag}.`);
+}
+// Tag will be of form `NSS_x_y_RTM`. Convert to `x.y`.
+returntag.split('_').slice(1,-1).join('.');
 };
 
 constoptions={
@@ -135,9 +104,9 @@ const {
 });
 
 if(values.help){
-console.log(`Usage: ${basename(__filename)} [OPTION]... [VERSION]...`);
+console.log(`Usage: ${basename(__filename)} [OPTION]... [RELEASE]...`);
 console.log();
-console.log('Updates certdata.txt to NSS VERSION (most recent release by default).');
+console.log('Updates certdata.txt to NSS version contained in Firefox RELEASE (default: most recent release).');
 console.log('');
 console.log(' -f, --file=FILE writes a commit message reflecting the change to the');
 console.log(' specified FILE');
@@ -146,29 +115,11 @@ if (values.help) {
 process.exit(0);
 }
 
-constscheduleURL='https://wiki.mozilla.org/NSS:Release_Versions';
-if(values.verbose){
-console.log(`Fetching NSS release schedule from ${scheduleURL}`);
-}
-constschedule=awaitfetch(scheduleURL);
-if(!schedule.ok){
-console.error(`Failed to fetch ${scheduleURL}: ${schedule.status}: ${schedule.statusText}`);
-process.exit(-1);
-}
-constscheduleText=awaitschedule.text();
-constnssReleases=getReleases(scheduleText);
-
+constfirefoxRelease=awaitgetFirefoxRelease(positionals[0]);
 // Retrieve metadata for the NSS release being updated to.
-constversion=positionals[0]??awaitgetLatestVersion(nssReleases);
-constrelease=nssReleases.find((r)=>{
-returnnewRegExp(`^${version.replace('.','\\.')}\\b`).test(r[kNSSVersion]);
-});
-if(!pastRelease(release)){
-console.warn(`Warning: NSS ${version} is not due to be released until ${formatDate(release[kNSSDate])}`);
-}
+constversion=awaitgetNSSVersion(firefoxRelease);
 if(values.verbose){
-console.log('Found NSS version:');
-console.log(release);
+console.log(`Updating to NSS version ${version}`);
 }
 
 // Fetch certdata.txt and overwrite the local copy.
@@ -213,14 +164,15 @@ const added = [ ...diff.matchAll(certsAddedRE) ].map((m) => m[1]);
 constremoved=[ ...diff.matchAll(certsRemovedRE)].map((m)=>m[1]);
 
 constcommitMsg=[
-`crypto: update root certificates to NSS ${release[kNSSVersion]}`,
+`crypto: update root certificates to NSS ${version}`,
 '',
-`This is the certdata.txt[0] from NSS ${release[kNSSVersion]}, released on ${formatDate(release[kNSSDate])}.`,
-'',
-`This is the version of NSS that ${release[kFirefoxDate]<now ? 'shipped' : 'will ship'} in Firefox ${release[kFirefoxVersion]} on`,
-`${formatDate(release[kFirefoxDate])}.`,
+`This is the certdata.txt[0] from NSS ${version}.`,
 '',
 ];
+if(firefoxRelease){
+commitMsg.push(`This is the version of NSS that shipped in Firefox ${firefoxRelease.version} on ${firefoxRelease.release_date}.`);
+commitMsg.push('');
+}
 if(added.length>0){
 commitMsg.push('Certificates added:');
 commitMsg.push(...added.map((cert)=>`- ${cert}`));
@@ -234,7 +186,7 @@ if (removed.length > 0) {
 commitMsg.push(`[0] ${certdataURL}`);
 constdelimiter=randomUUID();
 constproperties=[
-`NEW_VERSION=${release[kNSSVersion]}`,
+`NEW_VERSION=${version}`,
 `COMMIT_MSG<<${delimiter}`,
  ...commitMsg,
 delimiter,