mirror of
https://github.com/zotero/zotero.git
synced 2026-11-14 09:21:32 +00:00
78b9a3a1f3
Mozilla sends CRL updates via Remote Settings, which we don't use, so we
continue to trust revoked CA and intermediate certificates, including
the compromised eMudhra intermediates. Fetch the current list from
Mozilla at build time and apply the changes to the list on the first run
of each build.
Updating to the latest 153 ESR will also remove the eMudhra roots, which
will invalidate the intermediates as well, but that won't help Zotero
10, since 140 ESR is EOL, and most revoked intermediates are blocked
only via OneCRL without a root removal.
The test imports the cross-signed certificate into the certificate
database instead of passing it to asyncVerifyCertAtTime(), which
doesn't accept intermediates in Firefox 140.
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| 10.0_release_build_and_deploy | ||
| add_omni_file | ||
| add_version_info | ||
| beta_build_and_deploy | ||
| build_and_run | ||
| build_for_deploy | ||
| check_app_matches_commit | ||
| check_requirements | ||
| codesign_local | ||
| createprecomplete.py | ||
| dev_build_and_deploy | ||
| dir_build | ||
| fetch_mar_tools | ||
| fetch_onecrl | ||
| fetch_rcedit | ||
| fetch_xulrunner | ||
| get_commit_files | ||
| get_repo_branch_hash | ||
| incremental_update | ||
| manage_incrementals | ||
| notarization_info | ||
| notarization_stapler | ||
| notarize_mac_app | ||
| optimizejars.py | ||
| prepare_build | ||
| test_build_and_deploy | ||
| upload_builds | ||
| utils.sh | ||
| xulrunner_hash | ||