Bug 1073146 - Extensions update check fails due to "Certificate issuer is not built-in"
Extensions update check fails due to "Certificate issuer is not built-in"
Status: RESOLVED WORKSFORME
Classification: openSUSE
Product: openSUSE Tumbleweed
Classification: openSUSE
Component: Firefox
Current
Other Other
: P5 - None : Major (vote)
: Current
Assigned To: Wolfgang Rosenauer
E-mail List
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2017-12-15 18:19 UTC by Rainer Klute
Modified: 2017-12-17 16:08 UTC (History)
3 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Rainer Klute 2017-12-15 18:19:27 UTC
The extension update mechanism fails in the openSUSE build of Firefox, obviously due to not having included the (correct) built-in certificates.

This works fine in the Mozilla build, so it is definitely an openSUSE issue.

Please see https://bugzilla.mozilla.org/show_bug.cgi?id=1424478 for all the details. Thanks for fixing!
Comment 1 Frank Krüger 2017-12-16 08:49:45 UTC
I have recently observed this issue as well, with MozillaFirefox-57.0.1-1.8.x86_64 from the openSUSE Mozilla repo for TW and Leap 42.3. However, sometimes it works. I have definitly not seen this issue on my Windows machine so far.
Comment 2 Wolfgang Rosenauer 2017-12-16 12:17:57 UTC
How can I observe the failure?

I opened the "Browser console" and tried to manually update the extensions. There was no error though.
Comment 3 Rainer Klute 2017-12-16 13:54:29 UTC
Hm, what can I say? I provided all the details in https://bugzilla.mozilla.org/show_bug.cgi?id=1424478 already.

The only thing I could imagine is some legacy from former Firefox versions or extensions, since my Firefox profile is 11 years old and has undergone many changes. On the other hand, I tried this with a fresh testing profile and also experienced the error. Are there any other files outside of profiles that could have an effect?
Comment 4 Wolfgang Rosenauer 2017-12-16 14:19:55 UTC
Do you experience any other certificate issues?

Please list your installed packages 
rpm -qa | grep -E '-nss|freebl|softokn'
Comment 5 Wolfgang Rosenauer 2017-12-16 14:20:24 UTC
The above line misses the escape for -nss -> \-nss
Comment 6 Rainer Klute 2017-12-16 16:35:28 UTC
I don't experience other certificate issues.

machine:~ # rpm -qa | grep -E 'freebl|softokn|-nss' | sort
libfreebl3-3.28.6-44.1.x86_64
libfreebl3-32bit-3.28.6-44.1.x86_64
libsoftokn3-3.28.6-44.1.x86_64
libsoftokn3-32bit-3.28.6-44.1.x86_64
mozilla-nss-32bit-3.28.6-44.1.x86_64
mozilla-nss-3.33-2.1.x86_64
mozilla-nss-certs-3.28.6-44.1.x86_64
mozilla-nss-certs-32bit-3.28.6-44.1.x86_64
mozilla-nss-tools-3.28.6-44.1.x86_64
Comment 7 Wolfgang Rosenauer 2017-12-16 17:05:41 UTC
Do you have that issue with Firefox 57 or 52.x?

The upstream bug is about 57 so I guess it's that.
In that case I think the explanation is simple.
You have a mixed installation of 3.33 and 3.28.6 NSS.
Every single package above should be on the same version level.
This is not enforced from dependencies because technically it's possible to mix in some boundaries but at least the mozilla-nss-certs-3.28.6-44.1.x86_64 is most likely your problem.

Please update all packages and check again and reopen if you still can reproduce afterwards.
Comment 8 Rainer Klute 2017-12-17 16:08:47 UTC
(In reply to Wolfgang Rosenauer from comment #7)

Thanks, Wolfgang! I removed the 32-bit libraries, updated everything else to 3.33, and now it works nicely.

Perhaps it would be helpful to wire this into the package dependencies.

> Do you have that issue with Firefox 57 or 52.x?
> 
> The upstream bug is about 57 so I guess it's that.
> In that case I think the explanation is simple.
> You have a mixed installation of 3.33 and 3.28.6 NSS.
> Every single package above should be on the same version level.
> This is not enforced from dependencies because technically it's possible to
> mix in some boundaries but at least the mozilla-nss-certs-3.28.6-44.1.x86_64
> is most likely your problem.
> 
> Please update all packages and check again and reopen if you still can
> reproduce afterwards.