recover_store_gecko.patch

# HG changeset patch
# Parent bccef8483ead847546618b190e5e9c8c2f9ccb6c
# User Antonio M. Amaya <amac@tid.es>
Recover TID store
* * *
Bug 1155245 - Set the app status correctly for hosted certified apps in developer mode

diff --git a/b2g/confvars.sh b/b2g/confvars.sh
--- a/b2g/confvars.sh
+++ b/b2g/confvars.sh
@@ -47,16 +47,17 @@ MOZ_USE_NATIVE_POPUP_WINDOWS=1
 MOZ_XULRUNNER=

 MOZ_MEDIA_NAVIGATOR=1

 MOZ_APP_ID={3c2e2abc-06d4-11e1-ac3b-374f68613e61}

 MOZ_TIME_MANAGER=1

+MOZ_B2G_CERTDATA=1
 MOZ_SIMPLEPUSH=1
 MOZ_PAY=1
 MOZ_TOOLKIT_SEARCH=
 MOZ_PLACES=
 MOZ_B2G=1

 if test "$OS_TARGET" = "Android"; then
 MOZ_NUWA_PROCESS=1
diff --git a/config/external/nss/Makefile.in b/config/external/nss/Makefile.in
--- a/config/external/nss/Makefile.in
+++ b/config/external/nss/Makefile.in
@@ -258,16 +258,20 @@ DEFAULT_GMAKE_FLAGS += MODULE_INCLUDES='
 
 # Work around NSS's MAKE_OBJDIR being racy. See bug #836220
 DEFAULT_GMAKE_FLAGS += MAKE_OBJDIR='$$(INSTALL) -D $$(OBJDIR)'
 
 # Work around NSS adding IMPORT_LIBRARY to TARGETS with no rule for
 # it, creating race conditions. See bug #836220
 DEFAULT_GMAKE_FLAGS += TARGETS='$$(LIBRARY) $$(SHARED_LIBRARY) $$(PROGRAM)'
 
+ifdef MOZ_B2G_CERTDATA
+include $(srcdir)/b2g-certdata.mk
+endif
+
 ifdef MOZ_FOLD_LIBS_FLAGS
 DEFAULT_GMAKE_FLAGS += XCFLAGS='$(MOZ_FOLD_LIBS_FLAGS)'
 endif
 
 NSS_SRCDIR = $(topsrcdir)
 
 NSS_DIRS =
 ifndef MOZ_FOLD_LIBS
diff --git a/config/external/nss/b2g-app-root-cert.der b/config/external/nss/b2g-app-root-cert.der
new file mode 100644
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..85c2fed92a963b2ff51ee92165d6ed59fa70aeff
GIT binary patch
literal 1177
zc$_n6Vwq~t#9X_8nTe5!iILHOmyJ`a&7<u*FC!xlD}zB}uOYVqCmVAp3!5-gXt1G-
zffR_tB`oZlUzM4Ylc?aFUsRA^lvt9PpJ!-pU<#7u7S@Bw`X&}-r<N4tBqpaS1Qg|`
zlqQ1|Dg<Yy=Vj)lD+H$&m1QQU8mb$pf;2J<%N6D4m*^%Z>K4Ei>*gZNFpv}HH8eIb
zGBP(XFf=hWixTHG0&z{D+(GBwCPoG1AZ27_U~XdMWdMqEFf}nUGAu93?6x~G>GPeO
zv@|}0)6I{fIUCzrAI{tAS#&?A*vCgt_>ah+{1%VNA#=Twve+~K9h!HxJR`$=b$fMy
zEPEAS>}EsXmGX7}W43Nr4qkg(rK545z=IO?FJWhy@-BTd*=qdN``Uz{ZqC)(f*ErY
z*jF)xFTdbfwcpU;YTeo|-$FuJ?cTPm<6N`gw}IaaKL;M!`;Oed!c-Ptn|^66lR%GE
z$iB`Tmt}?9tMZoL{;H<eEwNRyd;Y7njCT%a#z*Y6P+@v<Ms=U<;kA*m+RGXY+H4{+
zbRBx9e^^v7Wuf!?I{{2HEsXxkU(8tcVr$Pv3Cm!Q{kaz&o&Dfu`Qo2Qb<x8Ii~ch)
zGB0lYZ_xP1fCm_$vcfE^2F#3%{|)#+JboaHg$0;0*$l)$d{q#i$AF8CLz|6}m6e^D
z*`RR=NJ5#VagIUb%!Q4Umo!coY-s=(%?7d{SMsrlv4|wse|m7qNO8vhZOW-$_8<1X
zI=(aqEz>cB5{B{V2Ma2CR;O0jE$YAjNxqut$xi!SdZJrdbq!y-II=C9GLL(8o!Y$F
z9^0nQu#waL=4#bny6{5l#I6Z?Jdd{8rdR!Zzn102?mVxu2geSX$D02+86NPEoBcrJ
z(wb><tCdvx`#;E7e9C(4T{h+CkwBSA@7DTqwiF1Y?D}~7VP@=3!{RF(`yQ@}6)yT$
zyY@xt>jlOu%%h%mR(yZ5P$jSNJBL*mhoN@p(!SD7>ie&n9QmVrd(W*eA3K7&T^2t&
z_e6ftVs)OF$=}|6RyWOE7_rLgLdU5$$5c0@g<Nm<FF6pod}ry8p4IQ_Ej17Cj{oX#
ZI(c4CbiY}~YI(0&s*9Zxw%F<11^|(Pxb*-4

diff --git a/config/external/nss/b2g-certdata.mk b/config/external/nss/b2g-certdata.mk
new file mode 100644
--- /dev/null
+++ b/config/external/nss/b2g-certdata.mk
@@ -0,0 +1,35 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# On B2G, we need to remove the trust bits for code signing from all the
+# built-in CAs, because we are redefining the code signing bit to mean
+# "is trusted to issue certs that are trusted for signing apps," which none
+# of the normal built-in CAs are. This is a temporary hack until we can use
+# libpkix to verify the certificates. (libpkix gives the flexibility we need
+# to verify certificates using different sets of trust anchors per validation.)
+#
+# Whenever we change the B2G app signing trust anchor, we need to manually
+# update certdata-b2g.txt. To do so:
+#
+# 1. replace ./b2g-app-root-cert.der with the new DER-encoded root cert
+#
+# 2. In this directory run:
+#
+#     PATH=$NSS/bin:$NSS/lib addbuiltin -n "b2g-app-root-cert" -t ",,Cu" \
+#       < b2g-app-root-cert.der > b2g-certdata.txt
+#
+# Then, commit the changes. We don't do this step as part of the build because
+# we do not build addbuiltin as part of a Gecko build.
+
+# Distrust all existing builtin CAs for code-signing
+hacked-certdata.txt : $(srcdir)/../../../security/nss/lib/ckfw/builtins/certdata.txt
+	sed -e "s/^CKA_TRUST_CODE_SIGNING.*CKT_NSS_TRUSTED_DELEGATOR.*/CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_MUST_VERIFY_TRUST/" \
+			$< > $@
+
+combined-certdata.txt : hacked-certdata.txt $(srcdir)/b2g-certdata.txt
+	cat $^ > $@
+
+libs-nss/lib libs-nss/lib/ckfw: combined-certdata.txt
+
+DEFAULT_GMAKE_FLAGS += NSS_CERTDATA_TXT='$(CURDIR)/combined-certdata.txt'
diff --git a/config/external/nss/b2g-certdata.txt b/config/external/nss/b2g-certdata.txt
new file mode 100644
--- /dev/null
+++ b/config/external/nss/b2g-certdata.txt
@@ -0,0 +1,554 @@
+
+#
+# Certificate "b2g-app-root-cert"
+#
+# Issuer: CN=root-ca-production-marketplace,OU=Mozilla Marketplace Production Signing Service,O=Mozilla Corporation,C=US
+# Serial Number: 1 (0x1)
+# Subject: CN=root-ca-production-marketplace,OU=Mozilla Marketplace Production Signing Service,O=Mozilla Corporation,C=US
+# Not Valid Before: Wed Feb 27 00:14:56 2013
+# Not Valid After : Sat Feb 25 00:14:56 2023
+# Fingerprint (MD5): 88:28:0F:FD:5E:1C:AB:EE:5A:2A:EA:80:40:52:75:8D
+# Fingerprint (SHA1): 1B:EC:5F:10:98:02:35:7F:CD:7C:7E:A9:1B:D0:B0:96:4D:EA:79:34
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "b2g-app-root-cert"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\201\215\061\013\060\011\006\003\125\004\006\023\002\125\123
+\061\034\060\032\006\003\125\004\012\023\023\115\157\172\151\154
+\154\141\040\103\157\162\160\157\162\141\164\151\157\156\061\067
+\060\065\006\003\125\004\013\023\056\115\157\172\151\154\154\141
+\040\115\141\162\153\145\164\160\154\141\143\145\040\120\162\157
+\144\165\143\164\151\157\156\040\123\151\147\156\151\156\147\040
+\123\145\162\166\151\143\145\061\047\060\045\006\003\125\004\003
+\023\036\162\157\157\164\055\143\141\055\160\162\157\144\165\143
+\164\151\157\156\055\155\141\162\153\145\164\160\154\141\143\145
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\201\215\061\013\060\011\006\003\125\004\006\023\002\125\123
+\061\034\060\032\006\003\125\004\012\023\023\115\157\172\151\154
+\154\141\040\103\157\162\160\157\162\141\164\151\157\156\061\067
+\060\065\006\003\125\004\013\023\056\115\157\172\151\154\154\141
+\040\115\141\162\153\145\164\160\154\141\143\145\040\120\162\157
+\144\165\143\164\151\157\156\040\123\151\147\156\151\156\147\040
+\123\145\162\166\151\143\145\061\047\060\045\006\003\125\004\003
+\023\036\162\157\157\164\055\143\141\055\160\162\157\144\165\143
+\164\151\157\156\055\155\141\162\153\145\164\160\154\141\143\145
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\001\001
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\004\225\060\202\003\175\240\003\002\001\002\002\001\001
+\060\015\006\011\052\206\110\206\367\015\001\001\014\005\000\060
+\201\215\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+\034\060\032\006\003\125\004\012\023\023\115\157\172\151\154\154
+\141\040\103\157\162\160\157\162\141\164\151\157\156\061\067\060
+\065\006\003\125\004\013\023\056\115\157\172\151\154\154\141\040
+\115\141\162\153\145\164\160\154\141\143\145\040\120\162\157\144
+\165\143\164\151\157\156\040\123\151\147\156\151\156\147\040\123
+\145\162\166\151\143\145\061\047\060\045\006\003\125\004\003\023
+\036\162\157\157\164\055\143\141\055\160\162\157\144\165\143\164
+\151\157\156\055\155\141\162\153\145\164\160\154\141\143\145\060
+\036\027\015\061\063\060\062\062\067\060\060\061\064\065\066\132
+\027\015\062\063\060\062\062\065\060\060\061\064\065\066\132\060
+\201\215\061\013\060\011\006\003\125\004\006\023\002\125\123\061
+\034\060\032\006\003\125\004\012\023\023\115\157\172\151\154\154
+\141\040\103\157\162\160\157\162\141\164\151\157\156\061\067\060
+\065\006\003\125\004\013\023\056\115\157\172\151\154\154\141\040
+\115\141\162\153\145\164\160\154\141\143\145\040\120\162\157\144
+\165\143\164\151\157\156\040\123\151\147\156\151\156\147\040\123
+\145\162\166\151\143\145\061\047\060\045\006\003\125\004\003\023
+\036\162\157\157\164\055\143\141\055\160\162\157\144\165\143\164
+\151\157\156\055\155\141\162\153\145\164\160\154\141\143\145\060
+\202\001\040\060\015\006\011\052\206\110\206\367\015\001\001\001
+\005\000\003\202\001\015\000\060\202\001\010\002\202\001\001\000
+\247\162\151\213\076\310\222\363\334\154\146\146\016\060\313\203
+\342\133\011\201\206\205\341\236\265\111\162\337\154\163\114\114
+\056\023\374\024\374\157\204\110\223\124\235\112\142\152\007\151
+\376\302\236\315\167\150\150\067\253\207\173\120\035\007\172\016
+\135\263\061\115\251\037\176\377\134\265\267\043\123\255\333\044
+\210\201\276\020\340\164\047\364\126\315\002\156\322\366\064\265
+\063\365\113\326\220\122\213\011\253\053\021\150\235\140\007\252
+\000\127\247\320\111\172\277\061\100\325\176\255\364\366\124\125
+\005\076\355\204\256\011\254\240\373\060\116\350\116\100\014\035
+\337\101\013\372\126\044\243\326\227\322\255\002\020\214\072\124
+\276\211\154\104\246\161\267\172\156\247\333\365\046\056\213\030
+\265\031\213\237\352\255\001\334\303\151\137\130\275\070\044\002
+\344\314\045\276\075\303\255\131\135\053\246\200\060\206\074\130
+\150\055\100\215\227\360\242\160\224\241\103\357\334\120\002\231
+\070\062\375\037\321\150\246\350\265\214\261\030\071\123\110\277
+\155\320\342\315\360\106\071\350\376\024\173\162\341\340\242\377
+\002\001\003\243\201\377\060\201\374\060\014\006\003\125\035\023
+\004\005\060\003\001\001\377\060\016\006\003\125\035\017\001\001
+\377\004\004\003\002\001\006\060\026\006\003\125\035\045\001\001
+\377\004\014\060\012\006\010\053\006\001\005\005\007\003\003\060
+\201\244\006\003\125\035\043\004\201\234\060\201\231\241\201\223
+\244\201\220\060\201\215\061\013\060\011\006\003\125\004\006\023
+\002\125\123\061\034\060\032\006\003\125\004\012\023\023\115\157
+\172\151\154\154\141\040\103\157\162\160\157\162\141\164\151\157
+\156\061\067\060\065\006\003\125\004\013\023\056\115\157\172\151
+\154\154\141\040\115\141\162\153\145\164\160\154\141\143\145\040
+\120\162\157\144\165\143\164\151\157\156\040\123\151\147\156\151
+\156\147\040\123\145\162\166\151\143\145\061\047\060\045\006\003
+\125\004\003\023\036\162\157\157\164\055\143\141\055\160\162\157
+\144\165\143\164\151\157\156\055\155\141\162\153\145\164\160\154
+\141\143\145\202\001\001\060\035\006\003\125\035\016\004\026\004
+\024\143\177\362\340\322\062\041\230\377\266\043\145\112\077\360
+\275\352\307\245\154\060\015\006\011\052\206\110\206\367\015\001
+\001\014\005\000\003\202\001\001\000\063\313\340\240\170\214\253
+\145\170\076\242\217\337\362\037\173\002\344\271\077\272\056\025
+\265\005\055\061\351\104\101\006\246\224\236\013\253\176\046\236
+\233\110\266\225\230\074\036\053\366\105\072\217\165\241\320\205
+\221\212\220\056\014\342\265\075\147\172\371\357\255\004\350\273
+\156\112\166\340\306\302\067\135\067\374\311\127\120\341\013\007
+\300\201\245\174\226\036\253\042\044\217\217\360\034\070\362\152
+\343\113\166\224\371\304\121\034\222\356\255\115\011\204\160\020
+\144\272\361\333\341\151\135\271\061\163\324\010\276\341\252\135
+\023\162\376\175\255\350\165\353\240\063\250\067\132\345\211\170
+\367\344\241\044\156\201\367\010\072\126\010\061\053\125\245\216
+\165\262\047\277\325\064\304\374\055\333\274\332\364\361\210\122
+\213\104\243\342\316\344\037\242\243\047\014\134\223\366\356\363
+\047\065\155\241\130\252\072\320\210\312\354\306\045\260\146\124
+\327\207\117\164\300\131\247\271\165\370\214\253\356\177\071\051
+\303\273\137\365\100\313\143\236\214\133\217\066\150\253\037\112
+\232\045\243\102\140\264\076\054\333
+END
+
+# Trust for "b2g-app-root-cert"
+# Issuer: CN=root-ca-production-marketplace,OU=Mozilla Marketplace Production Signing Service,O=Mozilla Corporation,C=US
+# Serial Number: 1 (0x1)
+# Subject: CN=root-ca-production-marketplace,OU=Mozilla Marketplace Production Signing Service,O=Mozilla Corporation,C=US
+# Not Valid Before: Wed Feb 27 00:14:56 2013
+# Not Valid After : Sat Feb 25 00:14:56 2023
+# Fingerprint (MD5): 88:28:0F:FD:5E:1C:AB:EE:5A:2A:EA:80:40:52:75:8D
+# Fingerprint (SHA1): 1B:EC:5F:10:98:02:35:7F:CD:7C:7E:A9:1B:D0:B0:96:4D:EA:79:34
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "b2g-app-root-cert"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\033\354\137\020\230\002\065\177\315\174\176\251\033\320\260\226
+\115\352\171\064
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\210\050\017\375\136\034\253\356\132\052\352\200\100\122\165\215
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\201\215\061\013\060\011\006\003\125\004\006\023\002\125\123
+\061\034\060\032\006\003\125\004\012\023\023\115\157\172\151\154
+\154\141\040\103\157\162\160\157\162\141\164\151\157\156\061\067
+\060\065\006\003\125\004\013\023\056\115\157\172\151\154\154\141
+\040\115\141\162\153\145\164\160\154\141\143\145\040\120\162\157
+\144\165\143\164\151\157\156\040\123\151\147\156\151\156\147\040
+\123\145\162\166\151\143\145\061\047\060\045\006\003\125\004\003
+\023\036\162\157\157\164\055\143\141\055\160\162\157\144\165\143
+\164\151\157\156\055\155\141\162\153\145\164\160\154\141\143\145
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\001\001
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_MUST_VERIFY_TRUST
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "TID ROOT CA"
+#
+# Issuer: CN=ROOTCATID
+# Serial Number:5c:b7:72:01:e4:e1:f1:83:43:d8:2a:30:87:ab:8a:19
+# Subject: CN=ROOTCATID
+# Not Valid Before: Fri May 14 07:14:39 2010
+# Not Valid After : Tue May 14 07:24:35 2030
+# Fingerprint (MD5): 03:44:5E:A7:FB:A7:43:AD:8A:4A:99:35:C2:E7:E6:4B
+# Fingerprint (SHA1): 7D:4C:BC:E9:CB:DA:D7:6A:5D:0C:AA:AE:C5:2D:47:3F:3E:41:A4:E0
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "TID ROOT CA"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\024\061\022\060\020\006\003\125\004\003\023\011\122\117\117
+\124\103\101\124\111\104
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\024\061\022\060\020\006\003\125\004\003\023\011\122\117\117
+\124\103\101\124\111\104
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\134\267\162\001\344\341\361\203\103\330\052\060\207\253
+\212\031
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\003\052\060\202\002\022\240\003\002\001\002\002\020\134
+\267\162\001\344\341\361\203\103\330\052\060\207\253\212\031\060
+\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060\024
+\061\022\060\020\006\003\125\004\003\023\011\122\117\117\124\103
+\101\124\111\104\060\036\027\015\061\060\060\065\061\064\060\067
+\061\064\063\071\132\027\015\063\060\060\065\061\064\060\067\062
+\064\063\065\132\060\024\061\022\060\020\006\003\125\004\003\023
+\011\122\117\117\124\103\101\124\111\104\060\202\001\042\060\015
+\006\011\052\206\110\206\367\015\001\001\001\005\000\003\202\001
+\017\000\060\202\001\012\002\202\001\001\000\275\244\376\232\136
+\365\205\335\047\242\167\070\021\240\341\133\156\013\275\324\056
+\344\057\147\357\341\065\140\166\166\151\145\074\024\051\317\030
+\003\105\005\327\277\362\206\060\271\267\277\164\340\331\067\213
+\243\353\351\064\273\205\244\332\073\035\151\326\345\112\276\075
+\144\350\314\041\323\142\167\335\047\002\015\175\142\041\200\177
+\017\042\163\326\330\134\177\102\216\360\037\231\355\364\075\217
+\342\370\026\167\134\007\322\267\310\015\201\355\265\350\230\142
+\040\242\157\272\241\151\036\162\242\162\344\125\010\226\347\354
+\171\265\061\174\054\076\336\173\370\252\215\262\160\245\117\344
+\020\314\256\144\273\272\300\216\356\054\276\137\000\247\206\253
+\167\040\261\215\156\245\062\234\353\312\012\153\115\214\007\001
+\326\356\036\035\203\022\374\170\151\273\224\111\054\242\166\211
+\044\031\270\136\370\061\355\111\370\326\166\032\000\116\155\034
+\005\042\307\270\211\006\127\367\037\065\147\256\331\116\256\365
+\152\227\353\231\004\157\023\117\043\163\225\231\145\065\160\116
+\040\133\036\136\066\310\160\046\251\241\057\002\003\001\000\001
+\243\170\060\166\060\013\006\003\125\035\017\004\004\003\002\001
+\206\060\017\006\003\125\035\023\001\001\377\004\005\060\003\001
+\001\377\060\035\006\003\125\035\016\004\026\004\024\230\112\034
+\014\033\047\136\212\261\357\155\101\140\051\344\120\344\166\127
+\342\060\022\006\011\053\006\001\004\001\202\067\025\001\004\005
+\002\003\003\000\003\060\043\006\011\053\006\001\004\001\202\067
+\025\002\004\026\004\024\334\273\241\332\013\204\254\323\201\332
+\020\050\272\247\161\100\342\307\255\267\060\015\006\011\052\206
+\110\206\367\015\001\001\005\005\000\003\202\001\001\000\001\061
+\340\024\237\036\271\015\003\032\263\201\012\075\321\225\224\330
+\062\315\012\341\366\241\250\221\173\244\140\346\330\146\273\372
+\002\067\305\216\200\231\361\144\065\051\015\067\251\161\004\330
+\333\047\277\323\074\140\204\336\263\065\073\073\123\314\337\255
+\303\256\077\216\213\212\021\275\143\201\123\066\063\115\166\035
+\372\366\270\315\146\240\341\150\226\043\060\163\372\330\332\137
+\310\235\360\367\237\232\217\330\302\152\362\141\250\134\017\352
+\314\177\346\234\037\027\273\324\343\255\265\246\000\150\112\035
+\154\075\211\366\133\274\011\376\237\040\057\327\141\331\320\212
+\136\364\222\205\365\302\215\076\245\035\272\231\327\167\007\215
+\061\016\167\270\275\342\151\363\223\335\205\142\005\343\136\162
+\345\314\222\360\131\261\265\227\307\250\040\137\215\147\220\205
+\353\201\361\232\363\331\244\250\205\366\312\215\023\122\144\333
+\262\155\073\204\257\026\220\160\241\331\351\204\243\132\115\017
+\300\240\233\167\347\322\120\023\224\250\011\331\337\101\327\047
+\206\345\205\307\343\117\243\010\365\212\310\300\151\011
+END
+
+# Trust for "TID ROOT CA"
+# Issuer: CN=ROOTCATID
+# Serial Number:5c:b7:72:01:e4:e1:f1:83:43:d8:2a:30:87:ab:8a:19
+# Subject: CN=ROOTCATID
+# Not Valid Before: Fri May 14 07:14:39 2010
+# Not Valid After : Tue May 14 07:24:35 2030
+# Fingerprint (MD5): 03:44:5E:A7:FB:A7:43:AD:8A:4A:99:35:C2:E7:E6:4B
+# Fingerprint (SHA1): 7D:4C:BC:E9:CB:DA:D7:6A:5D:0C:AA:AE:C5:2D:47:3F:3E:41:A4:E0
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "TID ROOT CA"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\175\114\274\351\313\332\327\152\135\014\252\256\305\055\107\077
+\076\101\244\340
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\003\104\136\247\373\247\103\255\212\112\231\065\302\347\346\113
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\024\061\022\060\020\006\003\125\004\003\023\011\122\117\117
+\124\103\101\124\111\104
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\020\134\267\162\001\344\341\361\203\103\330\052\060\207\253
+\212\031
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "TID INTERM CA"
+#
+# Issuer: CN=ROOTCATID
+# Serial Number:19:ce:c5:58:00:03:00:00:00:10
+# Subject: CN=ISSUECATID,DC=hi,DC=inet
+# Not Valid Before: Fri May 14 07:35:10 2010
+# Not Valid After : Thu May 14 07:45:10 2020
+# Fingerprint (MD5): 3F:75:3B:17:1C:18:63:23:D9:D3:9D:70:E8:F6:05:39
+# Fingerprint (SHA1): 55:08:7B:A5:05:C5:48:42:DC:C2:A3:52:EE:3F:D3:E9:5F:03:65:ED
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "TID INTERM CA"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\077\061\024\060\022\006\012\011\222\046\211\223\362\054\144
+\001\031\026\004\151\156\145\164\061\022\060\020\006\012\011\222
+\046\211\223\362\054\144\001\031\026\002\150\151\061\023\060\021
+\006\003\125\004\003\023\012\111\123\123\125\105\103\101\124\111
+\104
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\024\061\022\060\020\006\003\125\004\003\023\011\122\117\117
+\124\103\101\124\111\104
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\012\031\316\305\130\000\003\000\000\000\020
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\005\067\060\202\004\037\240\003\002\001\002\002\012\031
+\316\305\130\000\003\000\000\000\020\060\015\006\011\052\206\110
+\206\367\015\001\001\005\005\000\060\024\061\022\060\020\006\003
+\125\004\003\023\011\122\117\117\124\103\101\124\111\104\060\036
+\027\015\061\060\060\065\061\064\060\067\063\065\061\060\132\027
+\015\062\060\060\065\061\064\060\067\064\065\061\060\132\060\077
+\061\024\060\022\006\012\011\222\046\211\223\362\054\144\001\031
+\026\004\151\156\145\164\061\022\060\020\006\012\011\222\046\211
+\223\362\054\144\001\031\026\002\150\151\061\023\060\021\006\003
+\125\004\003\023\012\111\123\123\125\105\103\101\124\111\104\060
+\202\001\042\060\015\006\011\052\206\110\206\367\015\001\001\001
+\005\000\003\202\001\017\000\060\202\001\012\002\202\001\001\000
+\257\240\253\114\162\105\215\371\053\362\144\013\073\026\047\154
+\170\166\043\040\205\047\141\030\046\163\326\112\227\206\066\356
+\164\015\331\061\053\044\160\276\365\301\223\150\262\365\277\103
+\215\110\273\325\273\013\230\350\216\247\120\047\265\376\355\134
+\225\246\207\165\127\274\110\105\275\227\245\002\277\263\035\122
+\043\007\203\212\050\272\155\361\111\101\143\113\025\011\173\363
+\127\130\114\021\300\305\050\231\064\227\156\253\304\153\203\017
+\167\007\362\065\374\361\074\373\010\013\131\050\322\136\026\336
+\340\123\332\247\373\206\033\216\140\261\370\324\246\256\251\071
+\336\222\034\203\347\317\320\267\250\175\245\300\007\007\154\005
+\005\060\120\361\044\356\345\377\220\003\114\250\200\241\040\136
+\003\332\354\367\141\040\244\057\064\116\341\167\344\076\172\040
+\116\235\052\070\133\136\012\332\366\025\271\356\052\177\025\366
+\335\250\135\263\103\255\043\320\122\233\170\144\233\142\200\250
+\221\327\123\160\207\336\115\255\257\154\043\027\146\016\015\170
+\054\033\361\172\301\145\221\000\153\207\012\146\236\161\075\173
+\002\003\001\000\001\243\202\002\136\060\202\002\132\060\022\006
+\011\053\006\001\004\001\202\067\025\001\004\005\002\003\003\000
+\003\060\043\006\011\053\006\001\004\001\202\067\025\002\004\026
+\004\024\307\076\327\334\151\352\065\125\374\366\335\000\142\263
+\007\340\071\164\230\031\060\035\006\003\125\035\016\004\026\004
+\024\206\221\063\037\155\152\156\234\263\237\251\362\320\343\117
+\202\021\330\215\202\060\031\006\011\053\006\001\004\001\202\067
+\024\002\004\014\036\012\000\123\000\165\000\142\000\103\000\101
+\060\013\006\003\125\035\017\004\004\003\002\001\206\060\017\006
+\003\125\035\023\001\001\377\004\005\060\003\001\001\377\060\037
+\006\003\125\035\043\004\030\060\026\200\024\230\112\034\014\033
+\047\136\212\261\357\155\101\140\051\344\120\344\166\127\342\060
+\201\262\006\003\125\035\037\004\201\252\060\201\247\060\201\244
+\240\201\241\240\201\236\206\065\150\164\164\160\072\057\057\151
+\163\163\165\145\143\141\164\151\144\056\150\151\056\151\156\145
+\164\057\103\145\162\164\105\156\162\157\154\154\057\122\117\117
+\124\103\101\124\111\104\050\063\051\056\143\162\154\206\062\150
+\164\164\160\072\057\057\157\162\143\141\164\151\144\056\150\151
+\056\151\156\145\164\057\103\145\162\164\105\156\162\157\154\154
+\057\122\117\117\124\103\101\124\111\104\050\063\051\056\143\162
+\154\206\061\150\164\164\160\072\057\057\157\162\143\141\164\151
+\144\056\164\151\144\056\145\163\057\103\145\162\164\105\156\162
+\157\154\154\057\122\117\117\124\103\101\124\111\104\050\063\051
+\056\143\162\154\060\201\360\006\010\053\006\001\005\005\007\001
+\001\004\201\343\060\201\340\060\113\006\010\053\006\001\005\005
+\007\060\002\206\077\150\164\164\160\072\057\057\151\163\163\165
+\145\143\141\164\151\144\056\150\151\056\151\156\145\164\057\103
+\145\162\164\105\156\162\157\154\154\057\162\157\157\164\143\141
+\164\151\144\137\122\117\117\124\103\101\124\111\104\050\063\051
+\056\143\162\164\060\110\006\010\053\006\001\005\005\007\060\002
+\206\074\150\164\164\160\072\057\057\157\162\143\141\164\151\144
+\056\150\151\056\151\156\145\164\057\103\145\162\164\105\156\162
+\157\154\154\057\162\157\157\164\143\141\164\151\144\137\122\117
+\117\124\103\101\124\111\104\050\063\051\056\143\162\164\060\107
+\006\010\053\006\001\005\005\007\060\002\206\073\150\164\164\160
+\072\057\057\157\162\143\141\164\151\144\056\164\151\144\056\145
+\163\057\103\145\162\164\105\156\162\157\154\154\057\162\157\157
+\164\143\141\164\151\144\137\122\117\117\124\103\101\124\111\104
+\050\063\051\056\143\162\164\060\015\006\011\052\206\110\206\367
+\015\001\001\005\005\000\003\202\001\001\000\123\112\223\361\356
+\035\052\246\251\270\076\067\100\315\356\334\107\172\001\051\275
+\330\225\226\313\236\131\330\075\360\041\221\152\265\004\012\155
+\101\272\015\362\357\041\215\237\166\132\227\207\105\360\263\234
+\077\315\036\000\121\154\314\355\103\141\127\245\154\251\310\242
+\247\001\173\065\335\050\033\263\057\317\117\122\133\377\311\126
+\026\131\074\375\060\311\221\263\224\206\016\256\300\266\300\101
+\337\335\047\356\241\152\307\070\242\036\330\170\052\377\312\302
+\012\012\214\023\316\127\203\003\171\113\136\224\143\034\251\303
+\131\003\270\373\146\124\007\043\142\135\200\235\166\346\366\116
+\040\253\334\077\264\037\332\035\026\236\241\157\200\133\350\012
+\103\056\227\347\264\364\264\022\267\036\310\003\152\166\023\221
+\111\173\200\015\375\253\246\062\146\141\031\271\030\163\050\334
+\350\315\211\376\352\141\060\202\131\225\315\124\107\207\310\135
+\227\230\022\330\000\300\161\241\207\127\046\347\344\210\153\100
+\224\164\047\345\306\033\277\130\116\267\061\211\166\077\013\067
+\161\141\004\240\314\344\325\250\275\026\221
+END
+
+# Trust for "TID INTERM CA"
+# Issuer: CN=ROOTCATID
+# Serial Number:19:ce:c5:58:00:03:00:00:00:10
+# Subject: CN=ISSUECATID,DC=hi,DC=inet
+# Not Valid Before: Fri May 14 07:35:10 2010
+# Not Valid After : Thu May 14 07:45:10 2020
+# Fingerprint (MD5): 3F:75:3B:17:1C:18:63:23:D9:D3:9D:70:E8:F6:05:39
+# Fingerprint (SHA1): 55:08:7B:A5:05:C5:48:42:DC:C2:A3:52:EE:3F:D3:E9:5F:03:65:ED
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "TID INTERM CA"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\125\010\173\245\005\305\110\102\334\302\243\122\356\077\323\351
+\137\003\145\355
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\077\165\073\027\034\030\143\043\331\323\235\160\350\366\005\071
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\024\061\022\060\020\006\003\125\004\003\023\011\122\117\117
+\124\103\101\124\111\104
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\012\031\316\305\130\000\003\000\000\000\020
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
+
+#
+# Certificate "Test OWD Store CA"
+#
+# Issuer: CN=TID Test Signing CA,OU=Firefox OS Test Store,O=TID,C=ES
+# Serial Number: 1 (0x1)
+# Subject: CN=TID Test Signing CA,OU=Firefox OS Test Store,O=TID,C=ES
+# Not Valid Before: Wed Jan 09 13:10:52 2013
+# Not Valid After : Mon Jan 09 13:10:52 2017
+# Fingerprint (MD5): 95:D2:14:02:04:E8:6D:4E:43:53:06:F8:C3:93:88:F7
+# Fingerprint (SHA1): F9:0E:73:C3:53:8F:88:22:39:AD:54:0B:F7:D9:04:6E:D3:C1:88:53
+CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Test OWD Store CA"
+CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
+CKA_SUBJECT MULTILINE_OCTAL
+\060\131\061\013\060\011\006\003\125\004\006\023\002\105\123\061
+\014\060\012\006\003\125\004\012\023\003\124\111\104\061\036\060
+\034\006\003\125\004\013\023\025\106\151\162\145\146\157\170\040
+\117\123\040\124\145\163\164\040\123\164\157\162\145\061\034\060
+\032\006\003\125\004\003\023\023\124\111\104\040\124\145\163\164
+\040\123\151\147\156\151\156\147\040\103\101
+END
+CKA_ID UTF8 "0"
+CKA_ISSUER MULTILINE_OCTAL
+\060\131\061\013\060\011\006\003\125\004\006\023\002\105\123\061
+\014\060\012\006\003\125\004\012\023\003\124\111\104\061\036\060
+\034\006\003\125\004\013\023\025\106\151\162\145\146\157\170\040
+\117\123\040\124\145\163\164\040\123\164\157\162\145\061\034\060
+\032\006\003\125\004\003\023\023\124\111\104\040\124\145\163\164
+\040\123\151\147\156\151\156\147\040\103\101
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\001\001
+END
+CKA_VALUE MULTILINE_OCTAL
+\060\202\003\146\060\202\002\116\240\003\002\001\002\002\001\001
+\060\015\006\011\052\206\110\206\367\015\001\001\013\005\000\060
+\131\061\013\060\011\006\003\125\004\006\023\002\105\123\061\014
+\060\012\006\003\125\004\012\023\003\124\111\104\061\036\060\034
+\006\003\125\004\013\023\025\106\151\162\145\146\157\170\040\117
+\123\040\124\145\163\164\040\123\164\157\162\145\061\034\060\032
+\006\003\125\004\003\023\023\124\111\104\040\124\145\163\164\040
+\123\151\147\156\151\156\147\040\103\101\060\036\027\015\061\063
+\060\061\060\071\061\063\061\060\065\062\132\027\015\061\067\060
+\061\060\071\061\063\061\060\065\062\132\060\131\061\013\060\011
+\006\003\125\004\006\023\002\105\123\061\014\060\012\006\003\125
+\004\012\023\003\124\111\104\061\036\060\034\006\003\125\004\013
+\023\025\106\151\162\145\146\157\170\040\117\123\040\124\145\163
+\164\040\123\164\157\162\145\061\034\060\032\006\003\125\004\003
+\023\023\124\111\104\040\124\145\163\164\040\123\151\147\156\151
+\156\147\040\103\101\060\202\001\040\060\015\006\011\052\206\110
+\206\367\015\001\001\001\005\000\003\202\001\015\000\060\202\001
+\010\002\202\001\001\000\350\027\146\006\005\032\156\233\056\054
+\171\225\052\305\171\375\072\206\130\015\133\250\175\276\344\305
+\017\275\053\150\204\174\365\162\242\113\064\032\202\256\167\067
+\035\161\063\372\174\300\054\334\255\352\213\332\321\106\370\241
+\203\115\274\070\064\110\330\105\153\235\155\247\161\226\326\146
+\237\274\203\033\061\157\331\220\235\032\235\367\241\222\361\157
+\214\346\066\270\144\024\044\334\023\300\126\312\015\011\337\323
+\063\250\032\152\377\047\263\243\340\275\271\053\112\203\320\176
+\341\360\177\225\133\277\156\335\147\350\152\243\070\211\172\202
+\143\354\305\075\143\142\264\202\143\213\250\246\002\104\331\074
+\123\237\231\146\171\067\171\173\307\275\062\360\337\002\255\331
+\030\324\024\114\120\055\136\044\237\323\002\042\150\160\140\242
+\222\341\157\050\354\345\374\330\176\117\316\047\207\301\171\134
+\351\077\326\110\233\322\306\171\132\141\235\224\101\371\005\321
+\040\314\342\102\201\010\010\116\342\272\364\334\345\166\317\003
+\150\356\224\305\363\010\074\221\170\077\131\355\342\044\351\001
+\001\153\340\020\303\103\002\001\003\243\073\060\071\060\017\006
+\003\125\035\023\001\001\377\004\005\060\003\001\001\377\060\026
+\006\003\125\035\045\001\001\377\004\014\060\012\006\010\053\006
+\001\005\005\007\003\003\060\016\006\003\125\035\017\001\001\377
+\004\004\003\002\002\004\060\015\006\011\052\206\110\206\367\015
+\001\001\013\005\000\003\202\001\001\000\057\155\152\145\051\227
+\347\341\133\352\360\156\123\162\036\011\016\214\273\343\052\032
+\215\030\242\347\104\053\072\372\272\077\252\212\312\364\136\032
+\146\156\272\272\322\235\304\254\320\043\060\222\253\102\177\025
+\225\110\251\340\120\164\237\307\150\053\057\343\043\234\204\257
+\140\075\246\325\311\330\055\107\225\204\332\134\262\343\071\307
+\217\265\103\365\244\043\163\175\362\333\320\065\041\277\256\151
+\310\347\136\303\044\071\116\137\175\263\001\157\121\365\064\253
+\224\146\321\122\035\117\105\071\120\077\370\076\113\127\346\374
+\137\373\323\314\002\044\240\006\060\222\131\012\115\134\170\106
+\105\006\152\010\201\206\074\365\043\261\245\105\270\106\376\052
+\220\157\065\072\215\230\066\062\141\225\261\034\246\000\052\156
+\337\303\236\222\110\062\034\204\243\015\034\301\226\031\001\234
+\173\110\300\157\240\150\020\323\375\220\273\024\007\324\267\073
+\221\216\015\173\352\151\246\171\013\055\322\324\325\004\350\246
+\040\336\324\321\110\343\250\342\215\120\275\313\230\353\223\325
+\337\172\356\374\102\113\146\075\326\203
+END
+
+# Trust for "Test OWD Store CA"
+# Issuer: CN=TID Test Signing CA,OU=Firefox OS Test Store,O=TID,C=ES
+# Serial Number: 1 (0x1)
+# Subject: CN=TID Test Signing CA,OU=Firefox OS Test Store,O=TID,C=ES
+# Not Valid Before: Wed Jan 09 13:10:52 2013
+# Not Valid After : Mon Jan 09 13:10:52 2017
+# Fingerprint (MD5): 95:D2:14:02:04:E8:6D:4E:43:53:06:F8:C3:93:88:F7
+# Fingerprint (SHA1): F9:0E:73:C3:53:8F:88:22:39:AD:54:0B:F7:D9:04:6E:D3:C1:88:53
+CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
+CKA_TOKEN CK_BBOOL CK_TRUE
+CKA_PRIVATE CK_BBOOL CK_FALSE
+CKA_MODIFIABLE CK_BBOOL CK_FALSE
+CKA_LABEL UTF8 "Test OWD Store CA"
+CKA_CERT_SHA1_HASH MULTILINE_OCTAL
+\371\016\163\303\123\217\210\042\071\255\124\013\367\331\004\156
+\323\301\210\123
+END
+CKA_CERT_MD5_HASH MULTILINE_OCTAL
+\225\322\024\002\004\350\155\116\103\123\006\370\303\223\210\367
+END
+CKA_ISSUER MULTILINE_OCTAL
+\060\131\061\013\060\011\006\003\125\004\006\023\002\105\123\061
+\014\060\012\006\003\125\004\012\023\003\124\111\104\061\036\060
+\034\006\003\125\004\013\023\025\106\151\162\145\146\157\170\040
+\117\123\040\124\145\163\164\040\123\164\157\162\145\061\034\060
+\032\006\003\125\004\003\023\023\124\111\104\040\124\145\163\164
+\040\123\151\147\156\151\156\147\040\103\101
+END
+CKA_SERIAL_NUMBER MULTILINE_OCTAL
+\002\001\001
+END
+CKA_TRUST_SERVER_AUTH CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_EMAIL_PROTECTION CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_CODE_SIGNING CK_TRUST CKT_NSS_TRUSTED_DELEGATOR
+CKA_TRUST_STEP_UP_APPROVED CK_BBOOL CK_FALSE
diff --git a/configure.in b/configure.in
--- a/configure.in
+++ b/configure.in
@@ -7540,16 +7540,25 @@ dnl = Enable Support for SimplePush (Gon
 dnl   This will disable the Push API.
 dnl ========================================================
 if test -n "$MOZ_SIMPLEPUSH"; then
     AC_DEFINE(MOZ_SIMPLEPUSH)
 fi
 AC_SUBST(MOZ_SIMPLEPUSH)
 
 dnl ========================================================
+dnl = Enable Support B2G-specific changes to the NSS
+dnl = certificate trust database.
+dnl ========================================================
+if test -n "$MOZ_B2G_CERTDATA"; then
+    AC_DEFINE(MOZ_B2G_CERTDATA)
+fi
+AC_SUBST(MOZ_B2G_CERTDATA)
+
+dnl ========================================================
 dnl = Enable Support for Payment API
 dnl ========================================================
 if test -n "$MOZ_PAY"; then
     AC_DEFINE(MOZ_PAY)
 fi
 AC_SUBST(MOZ_PAY)
 
 dnl ========================================================
diff --git a/mobile/android/confvars.sh b/mobile/android/confvars.sh
--- a/mobile/android/confvars.sh
+++ b/mobile/android/confvars.sh
@@ -59,16 +59,19 @@ MOZ_ENABLE_SZIP=1
 fi
 
 # Enable navigator.mozPay
 MOZ_PAY=1
 
 # Enable UI for healthreporter
 MOZ_SERVICES_HEALTHREPORT=1
 
+# Enable the production cert for verifying signed packaged apps.
+MOZ_B2G_CERTDATA=1
+
 # Enable runtime locale switching.
 MOZ_LOCALE_SWITCHER=1
 
 # Enable second screen and casting support for external devices.
 MOZ_DEVICES=1
 
 # Enable second screen using native Android libraries, provided we're
 # not resource constrained.
diff --git a/security/apps/AppTrustDomain.cpp b/security/apps/AppTrustDomain.cpp
--- a/security/apps/AppTrustDomain.cpp
+++ b/security/apps/AppTrustDomain.cpp
@@ -196,16 +196,30 @@ AppTrustDomain::GetCertTrust(EndEntityOr
     uint32_t relevantTrustBit = endEntityOrCA == EndEntityOrCA::MustBeCA
                               ? CERTDB_TRUSTED_CA
                               : CERTDB_TRUSTED;
     if (((flags & (relevantTrustBit | CERTDB_TERMINAL_RECORD)))
             == CERTDB_TERMINAL_RECORD) {
       trustLevel = TrustLevel::ActivelyDistrusted;
       return Success;
     }
+
+#ifdef MOZ_B2G_CERTDATA
+    // XXX(Bug 972201): We have to allow the old way of supporting additional
+    // roots until we fix bug 889744. Remove this along with the rest of the
+    // MOZ_B2G_CERTDATA stuff.
+
+    // For TRUST, we only use the CERTDB_TRUSTED_CA bit, because Gecko hasn't
+    // needed to consider end-entity certs to be their own trust anchors since
+    // Gecko implemented nsICertOverrideService.
+    if (flags & CERTDB_TRUSTED_CA) {
+      trustLevel = TrustLevel::TrustAnchor;
+      return Success;
+    }
+#endif
   }
 
   // mTrustedRoot is the only trust anchor for this validation.
   if (CERT_CompareCerts(mTrustedRoot.get(), candidateCert.get())) {
     trustLevel = TrustLevel::TrustAnchor;
     return Success;
   }
 
diff --git a/security/apps/trusted-app-public.der b/security/apps/trusted-app-public.der
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..6c270e5d0444b5da4f60586e514383e8a9ab9090
GIT binary patch
literal 874
zc$_n6Vooz?V)9$S%*4pV#K>sC%f_kI=F#?@mywa1mBAp=klTQhjX9KsO_<3w*pSD7
z3&i0PW)AUmF_bfq0r9wnMcp!sQq%G)6#Rn~LQ;!M6oO0gi&70`45UEv%)-Jz)liAd
z^t{ZxbOmQe137VCLt_I&14~0=LjzNzC?MAyiAzhXn-~?4J<7<+z}&>h%K#MTU}|Dy
zWOyN-#>Og@H(O7qa;nzR%D+}^5xmhWYWF=k%D-1Tqow9+(IRgXsit-1=CXyxziJNX
z+*$jo`_@Ib9}Am(_gI*C+;GjFo4dSl+O@R#dzz&U^KVX=D>e7~!bu<Vd!Cu?ND)!F
zBYYt26ffuf%f>6Dvi_@YUi@J1PHnH|3v~}a)K87xpLaL?Mb=`A&Z?&5H%D!gleRP^
zcduB+<Z{y{c>c_^O7qI<<9m%h+-F*QQ{sw<Pk?Tm%KXbrN*M(SizYqH*Ld^v&y70&
zbL#B}D`Q^TU-OuK=~!h{;@l~YKUps-oO$Hb$id<FXxEoJPs`3TXS|zo^fQOe#0vY!
zw~tg_GBRdA5IF42#K^qZ+Q8C)9~g$R!i<dnSy&C2fs}z5NI(@N0E!L{Z8k<$R(57)
z13r*AKS-Q~nTd%7Efq0?!c;#uD^+v)^M}!|KI8=#$#L@a?0&2z)hn^+xr?^duU+=5
zx=wwGlS<3mwd>N{BWo@w8%$d5R4+Q!W95T@lKICowDlh=&uLkoV7u(<$s4-vQ(JDu
zY<g^Yynn0n*CoouwV!TZFjd^YF7w3mxWg)ze(|-N8S?|bnyj9Zb}>lS-_<g}{)e4+
z__IIpzb~I*Qdz)eFe#GDH>SePl`V^-vCZbI^2VjEJKX+hO~^O3>YZU`lsI*x%rXY8
zy!(geP4Y03X<5uGb8wm@<D6=b1NjRw1TO!buv>)v%699CeZ1ALGM80y>t4EYmF2}U
gg?m>ndOTk7s5fBm=^3vlU%g-T?vImqn(eh_05ESw!vFvP