Commit b8927dd
tools: fix updating root certificates
When searching for the latest certdata.txt, check that the file
exists on the remote server.
PR-URL: #47607
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent 1391d3b commit b8927dd
1 file changed
Lines changed: 27 additions & 11 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -22,6 +22,12 @@ const formatDate = (d) => { | |||
| 22 | 22 | return iso.substring(0, iso.indexOf('T')); | |
| 23 | 23 | }; | |
| 24 | 24 | ||
| 25 | + const getCertdataURL = (version) => { | ||
| 26 | + const tag = `NSS_${version.replaceAll('.', '_')}_RTM`; | ||
| 27 | + const certdataURL = `https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`; | ||
| 28 | + return certdataURL; | ||
| 29 | + }; | ||
| 30 | + | ||
| 25 | 31 | const normalizeTD = (text) => { | |
| 26 | 32 | // Remove whitespace and any HTML tags. | |
| 27 | 33 | return text?.trim().replace(/<.*?>/g, ''); | |
@@ -74,22 +80,33 @@ const getReleases = (text) => { | |||
| 74 | 80 | return releases; | |
| 75 | 81 | }; | |
| 76 | 82 | ||
| 77 | - const getLatestVersion = (releases) => { | ||
| 78 | - const arrayNumberSort = (x, y, i) => { | ||
| 83 | + const getLatestVersion = async (releases) => { | ||
| 84 | + const arrayNumberSortDescending = (x, y, i) => { | ||
| 79 | 85 | if (x[i] === undefined && y[i] === undefined) { | |
| 80 | 86 | return 0; | |
| 81 | 87 | } else if (x[i] === y[i]) { | |
| 82 | - return arrayNumberSort(x, y, i + 1); | ||
| 88 | + return arrayNumberSortDescending(x, y, i + 1); | ||
| 83 | 89 | } | |
| 84 | - return (x[i] ?? 0) - (y[i] ?? 0); | ||
| 90 | + return (y[i] ?? 0) - (x[i] ?? 0); | ||
| 85 | 91 | }; | |
| 86 | 92 | const extractVersion = (t) => { | |
| 87 | 93 | return t[kNSSVersion].split('.').map((n) => parseInt(n)); | |
| 88 | 94 | }; | |
| 89 | 95 | const releaseSorter = (x, y) => { | |
| 90 | - return arrayNumberSort(extractVersion(x), extractVersion(y), 0); | ||
| 96 | + return arrayNumberSortDescending(extractVersion(x), extractVersion(y), 0); | ||
| 91 | 97 | }; | |
| 92 | - return releases.sort(releaseSorter).filter(pastRelease).at(-1)[kNSSVersion]; | ||
| 98 | + // Return the most recent certadata.txt that exists on the server. | ||
| 99 | + const sortedReleases = releases.sort(releaseSorter).filter(pastRelease); | ||
| 100 | + for (const candidate of sortedReleases) { | ||
| 101 | + const candidateURL = getCertdataURL(candidate[kNSSVersion]); | ||
| 102 | + if (values.verbose) { | ||
| 103 | + console.log(`Trying ${candidateURL}`); | ||
| 104 | + } | ||
| 105 | + const response = await fetch(candidateURL, { method: 'HEAD' }); | ||
| 106 | + if (response.ok) { | ||
| 107 | + return candidate[kNSSVersion]; | ||
| 108 | + } | ||
| 109 | + } | ||
| 93 | 110 | }; | |
| 94 | 111 | ||
| 95 | 112 | const pastRelease = (r) => { | |
@@ -129,10 +146,10 @@ if (values.help) { | |||
| 129 | 146 | process.exit(0); | |
| 130 | 147 | } | |
| 131 | 148 | ||
| 149 | + const scheduleURL = 'https://wiki.mozilla.org/NSS:Release_Versions'; | ||
| 132 | 150 | if (values.verbose) { | |
| 133 | - console.log('Fetching NSS release schedule'); | ||
| 151 | + console.log(`Fetching NSS release schedule from ${scheduleURL}`); | ||
| 134 | 152 | } | |
| 135 | - const scheduleURL = 'https://wiki.mozilla.org/NSS:Release_Versions'; | ||
| 136 | 153 | const schedule = await fetch(scheduleURL); | |
| 137 | 154 | if (!schedule.ok) { | |
| 138 | 155 | console.error(`Failed to fetch ${scheduleURL}: ${schedule.status}: ${schedule.statusText}`); | |
@@ -142,7 +159,7 @@ const scheduleText = await schedule.text(); | |||
| 142 | 159 | const nssReleases = getReleases(scheduleText); | |
| 143 | 160 | ||
| 144 | 161 | // Retrieve metadata for the NSS release being updated to. | |
| 145 | - const version = positionals[0] ?? getLatestVersion(nssReleases); | ||
| 162 | + const version = positionals[0] ?? await getLatestVersion(nssReleases); | ||
| 146 | 163 | const release = nssReleases.find((r) => { | |
| 147 | 164 | return new RegExp(`^${version.replace('.', '\\.')}\\b`).test(r[kNSSVersion]); | |
| 148 | 165 | }); | |
@@ -155,8 +172,7 @@ if (values.verbose) { | |||
| 155 | 172 | } | |
| 156 | 173 | ||
| 157 | 174 | // Fetch certdata.txt and overwrite the local copy. | |
| 158 | - const tag = `NSS_${version.replaceAll('.', '_')}_RTM`; | ||
| 159 | - const certdataURL = `https://hg.mozilla.org/projects/nss/raw-file/${tag}/lib/ckfw/builtins/certdata.txt`; | ||
| 175 | + const certdataURL = getCertdataURL(version); | ||
| 160 | 176 | if (values.verbose) { | |
| 161 | 177 | console.log(`Fetching ${certdataURL}`); | |
| 162 | 178 | } | |
0 commit comments