re-introduce old nss im too tired for this

security/nss/automation/taskcluster/docker-acvp/Dockerfile

@@ -1,50 +0,0 @@
-# Minimal image with clang-format 3.9.
-FROM rust:1.64
-LABEL maintainer="iaroslav.gridin@tuni.fi"
-
-# for new clang/llvm
-RUN echo "deb http://ftp.debian.org/debian/ sid main" > /etc/apt/sources.list.d/sid.list \
- && apt-get update \
- && apt-get install -y --no-install-recommends \
-    ca-certificates \
-    locales \
-    python-dev-is-python3 \
-    mercurial \
-    python3-pip \
-    python-setuptools \
-    build-essential \
-    cargo \
-    rustc \
-    git \
-    gyp \
-    clang-15 \
-    libclang-rt-15-dev \
-    llvm-15 \
-    ninja-build \
-    binutils \
- && rm -rf /var/lib/apt/lists/* \
- && apt-get autoremove -y && apt-get clean -y
-
-ENV SHELL /bin/bash
-ENV USER worker
-ENV LOGNAME $USER
-ENV HOME /home/$USER
-ENV HOSTNAME taskcluster-worker
-ENV LANG en_US.UTF-8
-ENV LC_ALL $LANG
-ENV HOST localhost
-ENV DOMSUF localdomain
-
-RUN locale-gen $LANG \
- && DEBIAN_FRONTEND=noninteractive dpkg-reconfigure locales
-
-RUN useradd -d $HOME -s $SHELL -m $USER
-WORKDIR $HOME
-
-ADD bin $HOME/bin
-RUN chmod +x $HOME/bin/*
-
-USER $USER
-
-# Set a default command for debugging.
-CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-acvp/bin/checkout.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-set -v -e -x
-
-if [ $(id -u) = 0 ]; then
-    # Drop privileges by re-running this script.
-    exec su worker $0
-fi
-
-# Default values for testing.
-REVISION=${NSS_HEAD_REVISION:-default}
-REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
-
-# Clone NSS.
-hg clone -r $REVISION $REPOSITORY nss
-
-# Clone NSPR if needed.
-hg clone -r default https://hg.mozilla.org/projects/nspr
-
-if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
-  pushd nspr
-  cat ../nss/nspr.patch | patch -p1
-  popd
-fi
-

security/nss/automation/taskcluster/docker-acvp/bin/run.sh

@@ -1,26 +0,0 @@
-#!/bin/bash -eu
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-################################################################################
-export NSS_PATH=$PWD NSS_SOURCES_PATH=$PWD/nss
-export LD_LIBRARY_PATH=$PWD/dist/Debug/lib/
-export RUST_LOG=warn
-export RUSTFLAGS="-C instrument-coverage"
-cd nss
-CC=clang-15 CXX=clang++-15 ./build.sh -g -v --sourcecov --static --disable-tests
-
-git clone --depth=1 https://gitlab.com/nisec/nss-project/acvp-rust.git
-cd acvp-rust
-cargo build
-TESTRUN="cargo run --bin test -- --profdata-command llvm-profdata-15"
-echo "AES-GCM:"
-$TESTRUN acvp-rust/samples/aes-gcm.json symmetric nss
-echo "ECDSA:"
-$TESTRUN acvp-rust/samples/ecdsa.json ecdsa nss
-echo "RSA:"
-$TESTRUN acvp-rust/samples/rsa.json rsa nss
-echo "SHA-256:"
-$TESTRUN acvp-rust/samples/sha256.json sha nss

security/nss/automation/taskcluster/docker-builds/Dockerfile

@@ -2,7 +2,7 @@
 # default image, so it's a fair bit bigger.  Only use this for builds where
 # the smaller docker image is missing something.  These builds will run on
 # the leaner configuration.
-FROM ubuntu:bionic-20221215
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN dpkg --add-architecture i386
@@ -11,12 +11,12 @@ RUN apt-get update \
     build-essential \
     ca-certificates \
     clang-4.0 \
-    clang-10 \
     clang \
     cmake \
     curl \
     g++-4.8-multilib \
     g++-5-multilib \
+    g++-6-multilib \
     g++-multilib \
     git \
     gyp \
@@ -34,21 +34,21 @@ RUN apt-get update \
     pkg-config \
     valgrind \
     zlib1g-dev \
-    clang-format-10 \
-    sqlite3 \ 
-    libabigail-dev \
-    abigail-tools \
-    software-properties-common \ 
- && add-apt-repository ppa:ubuntu-toolchain-r/test -y \ 
- && apt-get update \
- && apt-get install --no-install-recommends -y \ 
-    gcc-11-multilib \
-    g++-11-multilib \
  && rm -rf /var/lib/apt/lists/* \
  && apt-get autoremove -y && apt-get clean -y
 
-RUN update-alternatives --install /usr/bin/clang-format \
-    clang-format $(which clang-format-10) 10
+# Latest version of abigail-tools
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends automake libtool libxml2-dev \
+ && git clone git://sourceware.org/git/libabigail.git /tmp/libabigail \
+ && cd /tmp/libabigail \
+ && autoreconf -fi \
+ && ./configure --prefix=/usr --disable-static --disable-apidoc --disable-manual \
+ && make && make install \
+ && rm -rf /tmp/libabigail \
+ && apt-get remove -y automake libtool libxml2-dev \
+ && rm -rf /var/lib/apt/lists/* \
+ && apt-get autoremove -y && apt-get clean -y
 
 ENV SHELL /bin/bash
 ENV USER worker

security/nss/automation/taskcluster/docker-clang-format/Dockerfile

@@ -1,18 +1,18 @@
-# Minimal image with clang-format 10
-FROM ubuntu:bionic-20221215
+# Minimal image with clang-format 3.9.
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
     ca-certificates \
-    clang-format-10 \
+    clang-format-3.9 \
     locales \
     mercurial \
  && rm -rf /var/lib/apt/lists/* \
  && apt-get autoremove -y && apt-get clean -y
 
 RUN update-alternatives --install /usr/bin/clang-format \
-    clang-format $(which clang-format-10) 10
+    clang-format $(which clang-format-3.9) 10
 
 ENV SHELL /bin/bash
 ENV USER worker

security/nss/automation/taskcluster/docker-decision/Dockerfile

@@ -1,5 +1,5 @@
 # Minimal image for running the decision task.
-FROM ubuntu:bionic-20221215
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN apt-get update \

security/nss/automation/taskcluster/docker-ecckiila/Dockerfile

@@ -1,50 +0,0 @@
-# Minimal image with clang-format 3.9.
-FROM ubuntu:bionic-20221215
-LABEL maintainer="iaroslav.gridin@tuni.fi"
-
-# for new clang/llvm
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-  ca-certificates \
-  locales \
-  cmake \
-  build-essential \
-  git \
-  clang-10 \
-  mercurial \
-  unifdef \
-  python3-mako \
-  libgmp-dev \
-  jq \
-  python3-setuptools \
-  python3-pip \
-  python3-dev \
-  clang-format-10 \
- && rm -rf /var/lib/apt/lists/* \
- && apt-get autoremove -y && apt-get clean -y
-
-RUN pip3 install fastecdsa
-
-ENV SHELL /bin/bash
-ENV USER worker
-ENV LOGNAME $USER
-ENV HOME /home/$USER
-ENV HOSTNAME taskcluster-worker
-ENV LANG en_US.UTF-8
-ENV LC_ALL $LANG
-ENV HOST localhost
-ENV DOMSUF localdomain
-
-RUN locale-gen $LANG \
- && DEBIAN_FRONTEND=noninteractive dpkg-reconfigure locales
-
-RUN useradd -d $HOME -s $SHELL -m $USER
-WORKDIR $HOME
-
-ADD bin $HOME/bin
-RUN chmod +x $HOME/bin/*
-
-USER $USER
-
-# Set a default command for debugging.
-CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-ecckiila/bin/ecckiila.sh

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-
-set -v -e -x
-
-if [ $(id -u) = 0 ]; then
-    # Drop privileges by re-running this script.
-    exec su worker $0
-fi
-
-git clone --depth=1 https://gitlab.com/nisec/ecckiila.git

security/nss/automation/taskcluster/docker-ecckiila/bin/run.sh

@@ -1,14 +0,0 @@
-#!/bin/bash -eu
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this
-# file, You can obtain one at http://mozilla.org/MPL/2.0/.
-#
-################################################################################
-
-set -e -x -v
-
-cd $HOME/ecckiila
-cp $HOME/nss/.clang-format ./
-for c in secp384r1 secp521r1; do (cd ecp/$c && cmake . && make && unifdef ecp_$c.c -URIG_NULL -DRIG_NSS -URIG_GOST -UOPENSSL_BUILDING_OPENSSL -UKIILA_OPENSSL_EMIT_CURVEDEF -UKIILA_UNUSED -UOPENSSL_NO_ASM -ULIB_TEST -x2 > tmp_ecp_$c.c && clang-format-10 -i tmp_ecp_$c.c && diff $HOME/nss/lib/freebl/ecl/ecp_$c.c tmp_ecp_$c.c); done;
-

security/nss/automation/taskcluster/docker-fuzz/Dockerfile

@@ -1,10 +1,10 @@
 # Dockerfile for running fuzzing tests.
-# Used for ASAN.
+# Used for ASAN and Coverity based static-analysis.
 # Note that when running this, you need to add `--cap-add SYS_PTRACE` to the
 # docker invocation or ASAN won't work.
 # On taskcluster for ASAN use `features: ["allowPtrace"]`.
 # See https://github.com/google/sanitizers/issues/764#issuecomment-276700920
-FROM ubuntu:bionic-20221215
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN dpkg --add-architecture i386

security/nss/automation/taskcluster/docker-fuzz32/Dockerfile

@@ -10,8 +10,6 @@ LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 RUN dpkg --add-architecture i386
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
-    apt-transport-https \
-    apt-utils \
     build-essential \
     ca-certificates \
     curl \

security/nss/automation/taskcluster/docker-gcc-4.4/Dockerfile

@@ -11,7 +11,6 @@ RUN apt-get update \
     make \
     patch \
     mercurial \
-    sqlite3 \
     zlib1g-dev \
  && rm -rf /var/lib/apt/lists/* \
  && apt-get autoremove -y && apt-get clean -y

security/nss/automation/taskcluster/docker-hacl/B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc

@@ -0,0 +1,143 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBFS+1SABEACnmkESkY7eZq0GhDjbkWpKmURGk9+ycsfAhA44NqUvf4tk1GPM
+5SkJ/fYedYZJaDVhIp98fHgucD0O+vjOzghtgwtITusYjiPHPFBd/MN+MQqSEAP+
+LUa/kjHLjgyXxKhFUIDGVaDWL5tKOA7/AQKl1TyJ8lz89NHQoUHFsF/hu10+qhJe
+V65d32MXFehIUSvegh8DrPuExrliSiORO4HOhuc6151dWA4YBWVg4rX5kfKrGMMT
+pTWnSSZtgoRhkKW2Ey8cmZUqPuUJIfWyeNVu1e4SFtAivLvu/Ymz2WBJcNA1ZlTr
+RCOR5SIRgZ453pQnI/Bzna2nnJ/TV1gGJIGRahj/ini0cs2x1CILfS/YJQ3rWGGo
+OxwG0BVmPk0cmLVtyTq8gUPwxcPUd6WcBKhot3TDMlrffZACnQwQjlVjk5S1dEEz
+atUfpEuNitU9WOM4jr/gjv36ZNCOWm95YwLhsuci/NddBN8HXhyvs+zYTVZEXa2W
+l/FqOdQsQqZBcJjjWckGKhESdd7934+cesGD3O8KaeSGxww7slJrS0+6QJ8oBoAB
+P/WCn/y2AiY2syEKp3wYIGJyAbsm542zMZ4nc7pYfSu49mcyhQQICmqN5QvOyYUx
+OSqwbAOUNtlOyeRLZNIKoXtTqWDEu5aEiDROTw6Rkq+dIcxPNgOLdeQ3HwARAQAB
+tCFIYW5zIFdlbm5ib3JnIDxoYW5zQGNocm9taXVtLm9yZz6JARwEEAECAAYFAlT2
+MQAACgkQVfXNcLtaBWnDKgf/fjusXk+kh1zuyn5eOCe16+2vV1lmXZrDIGdJtXDW
+ZtHKele1Yv1BA3kUi5tKQi+VOOrvHL0+TMjFWFiCy1sYJS9qgkS08kReI2nAnhZ7
+INdqEVxtVk1TTOhtYjOPy6txwujoICuPv5F4rHVhn1LPKGTLtYD2LOwf/8eKYQox
+51gaJ8dNxpcHE/iFOIDXdebJPufo3EhqDRihchxb8AVLhrNss7pGGG/tVfichmHK
+djPT2KfSh14pq1ahFOz0zH4nmTu7CCLnLAdRBHuhL8HVDbi0vKBtCiSmQggdxvoj
+u+hpXiiDFQoCjLh0zVCwtFqWDZbnKMTBNNF26aTmQ+2fiYkBMwQQAQgAHRYhBB/m
+NI7eqCWiKXDlxI3TBA8SPMP0BQJbcLU1AAoJEI3TBA8SPMP021sH/jD1m7azNCN6
+DVL1iDJT6uIIYCTylygH5XI46CRoWaz/LwdFnUqWHHTcQxJ5pIkWV9KF+SIgMT42
+brdZZmNvvSdX0odjFKqj5UR6w+wDN+uZ6Q40zu4pNoNzbk7pRpbFf1XIfGB1liyu
+m28EJ58IXu/0AV7FiDAHGGBqppK/cwQN8pGLwmz1n6YELtXeFmtOGnusO6iLYOE7
+3ByFCCqJB6twT5+7dDqFYqqQJgQ6jDTy19dDZ1vDhDttL+2Rn0OYXqPw7gy/1D2p
+Y1cM9PgPBsR4EXhbtV0uKUNomk8tM/HnGMFT0KirI/tSwEP3v9g5YH992mrvNuIV
+TkyQn0jGeMeJATMEEAEIAB0WIQRswFHTwdmkr54mDFjT45SsdE4uuwUCW3haCQAK
+CRDT45SsdE4uu4JjCACppkreiMrpJSREKbUscdOvFxFRYzkTFeSCwX9Ih7r5ENpa
+zjczfIqCCfWzioV6y4K0V04y8CXt/5S5a9vfW801pBUdF9nG4X8YbUn/xSe+8A9m
+MsfDjMNcF7Cp5czVoSS4/4oHm9mQUMYQsn3AwwCPDKFORRRv5Eb0om9JawKtt++7
+ZW0fOgDkvOCm14SN0UtVc4mxTx6iyxdMDgrKinBZVjxEh5oeqUyXh5TYM+XyWFVh
+/gDUvUWwLI0GUWNTyOyUQU1oPVp+sWqrEe1BXLVCKFVWaSTtgJtJ5FyP+z2uzRcv
+aanPOj/ohHAo8VBq9QbefYVAkShNBEuJkATnXhcGiQEzBBABCAAdFiEEvlzFWRM6
+4JjNAb2a+j2ZL9Cqr7wFAlkBCcIACgkQ+j2ZL9Cqr7yB9AgArj+0+i0DCo1nm4MF
+TLnW1Y9GF/Hq/mBva1MhkT0j3BzENK3xgqrqac8KqupsporNEmJ0ZbZzilJdZImb
+o4X5BFdmmnjMiGaH6GAiPqRBBHGvLV2r2pG467J4tOMWO3XipFRf7FibbfhAU1lV
+/GLWYTSwLqwWwBE8u5rriEvDngWUJw2Yd4Yqwduef7O6F+JfsGPRXFomR3387II0
+8AXo/C+P5cl64llaxV6BmkJhQ6ydL0/KwSkHVdlXugk1sPtV/qOyPQ5L1Ibqbsvh
+lLq/jhHlUUNLFjlQ2lrS9bhHGw9OIHTMJvS8RDrk0yAmoHAyRWNgbFN7aA62vBhq
+pcUVzokBMwQQAQgAHRYhBPZ+fW6ADyQOg+vIZ/9qyaZGTfCcBQJa+ZAwAAoJEP9q
+yaZGTfCcKMgH/jRxGfYhhGnlMnDLAEpYC+TGSDLMgmg9cOZbonqyMv+7Kts+pV03
+KUr9SPV+VtGtOxRNiqwFt6V2MHcwPJfTXuH/bBW/HCCpr6UlOVWqIiCNK0Gnpcj5
+rRt5unjG9CwsgyaK9QPI8bGin/c6m8BjwmEdfJ01ATLiUb8WuDHQy9OCyrEAnzSq
+FD5ZtFmAFxvzm2x1nwb5HPuqkOqbRatp8aRJzTxIeSJPpgLw0PawHKGN3Ckp7REc
+g26P1spkPe7SIVRsobH3al4uw7mgs7wiDWN3t8CdmuHAzmB2UrsR84JMTb45GboO
+Bc1CX8xZcHyNaDEpyWHav+P8nZqwfBm+cLiJAjMEEAEIAB0WIQSawVDb4dGOtiX0
++gWyD0lU8+/LPwUCW/4O9QAKCRCyD0lU8+/LPyI7EACWtj0GEb1VT02gKwtKwgFn
+RJ2pz8vYm188wgJwCJaL04d2D/VwE0jMvmfH80hSKgSLPAVMG06RIOb/tGhHsQKU
+zBlHiAFmfjlJo1FC/Mp44RrERRsFAWBg0/URIs4vP8+5Vl+5m70sZrQpKeq+6TLM
+1dQ0Ohz+QkQ04Z+DTroChWU8/7Uw0E3CqGGKYqPvDh54T1q4s8FoN0no8ZUlt/O+
+r/3c7awr85ZnxqtnHIcuMbVyIZ+gOqXdrLa85yZITsh4zQrjYuyTEg7dpziReyiZ
++rkpdIdFKl8YeD+d0JWzVm7kq9D4K3+x9C509z0IgJUT3bhsX/N0Yf/QUtUW5oxI
+T7fod86B/Q2M7zBTttFhd1vAjiSjEalK48SjTzWqTDYVIkea1+f1kZK5A0QlthqG
+P2zy5GUjZVzOiCSOhyEOvAorU3zKD2s84VFKlayZEqlHJh8u5U59TWBdkW3qZUJd
+ewW31xt0s8IovYSgOwX3wbsClQs6eVwNuCZT2yQAgAyXA5iFztBvDRQ0qmetvzV2
+Ay9SrjvkQ3qr/eZmbMErEwEUxIO4b1rctCQ6jcbyVxMTAZAfaDoVKWEMXNiF2KSw
+F9SSzGPIZDgiEXUlgaJBlUIYSFxrPuE+da0CM5RixyYIinU6AER6crl9C4C9XL6a
+u3jf+5MTGxviRGn2oQzSCYkCMwQQAQgAHRYhBKeHFU4z7cw4HFbYuaxFYRTTj42I
+BQJboq6kAAoJEKxFYRTTj42IWIAP/3rc9GjDTM4nI6Oi4OzLkwm/I2Vr7LUKG8oX
+8E4Nj3amvNGupzGySjB+vrM6APrMSScXunvM0f19LV84EnNrUQ3KFZcSC6r5WC0B
+2+TVRYGpY+6R9AQpqnuxicW0sa/AlV9WSEb4fDavCel2nW0arH4wkkCzTThUxoBB
+X4I9nf4ZzGoUnnDAwTD9rN0gpI6Td/7faa3t99dRLb6AHJ1KhvyiiV3lr0xtTssD
+xVHo0SpzQTnOcRJnYf/2rTny8bVfROPWieh6HuEiP7SxT1HyeTr4WSAjSCoG95O2
+b3OgSMl0Z82FRMoJYmxID/V5YqH7015SjCxKdYhEZVp9YwWruEJIH8r6MGbWYNAl
+REnyDvfGzAF0L0+gAUymDRmtp1jeXLo+HmLgVEUWegafs1TPfCWS/H9n10Upjmuq
+akituzacz6Kjleq9qbnl81Xmh4AKmOILRwE7Pmcbl8HATOrmi5EaKffjMdWFzOWh
+3U4/VsNDujqSTXD88EjGcpLiIiYefGy0sURJbIMTkfXVt3ruHLyuvhsRE/2QEAi7
+gWB0zuBV8iGBaag+6RQkxGdpemPiogzuDijqZHoUXlp7Q6IYLanXeweyivdrSyTB
+4HOECDbWEPZwk6tCxnuklW5iJndxBmxjSxefIMGU7G2JS9quppCVFCrKUjIWnf7b
+gXnNji5JiQIzBBABCAAdFiEExZuSbLy7rtFhdiOuHt8NuZ2LeoQFAluirpUACgkQ
+Ht8NuZ2LeoR/gQ/6A71JxUavzyBlCXlMy2Hx2+gOfy68b8UWl7DwKTOBSoZOzPC7
+dVCSTzoK8dRELqsp7CkFImWcEwLJWMptuH2I1nK+Ua8bvxJSMJnOlPxYE8Wz5EK3
+SQ2mQvifRezQTe8zjdpxEDSR6xocSiigvJow4X+Mivrxxj8sMgu1KA1ud2VGX/IR
+wMbwuBTH9YydgvzmFzTxdlJHEYmsI8koHrVWPHm//QqqPBn+qz2z9uAzDmGAiDYg
+qtQijo5IJC8ZjxgdcTfCkN6he+GhHtOhyP/KF/FcRHY83DoNCtqexQZWGuKtbd8o
+nQYtmemRFob5kR7GxuNdAqF74oQfXcvXZNtHSuN3VtLqkB4fzW+21JBJCsP3XCzd
+nKjR4erXNrQycmp3shSoJbnVvdbDwaVlWhDen1DvJb0Lj2sO3PQPcwVQbf5XHWR/
+ZCf2OQTfVgwFEB4/0Twv70XwYIui2Ry9hmTPbD4Nn+UXbMQ3SOp90tj/e2yY/MFt
+FvcIYcJTk9LM5IsnKgh+fSWDmdS3HD5Kjv2EPUHTNalruwwfmhS+ScJwM4XqHTJY
+JkB16j/Xv2FTF+6KlbA1zdOVycPzoFKjAENYccQBVo2B+WQac7dFDqGEVNal9z66
+DyU4ciAHl6PsbuN7DWeuScLoqq5jwx61bZgn71mUOYC1/47ypat2BKCOXZ2JAjME
+EgEIAB0WIQSm5op4O95BdGcqQkHwXKpE5VGK/wUCWie53AAKCRDwXKpE5VGK/3rM
+D/9jcYKOjYaPJh3Q7wNC1HjjUa73eo5GvJqyXbsXufIh/RAYgQkD08P5JgzfXvQ0
+zOQTtDlDTVG8VMFoBYeMJVDd0k9LBbaljxcttMPfOll+AlQGAL7iQIqTAndknkJL
+CFdl0ypa5GVsl1tzqmNC5fuMJ3vBoRtYbMitlHQkO0vLjZ7yl9fz+7YkREpEo/d5
+Ya8t4+L6el6lrETYaiGCTxHcbYD7VdiJxpxFQlpgl+XKtobrj70RocGQ5JwUNilC
+nRJKUb33lbmntwDwQ1y1AjCnhB++3GHjJDXBPgYFDCSZPCndKeOXhxmB2psFf41i
+8foJPJXuh1vWOqArdwseFCRM6W2deF1utZmROMSkUo6IC8dYlucO/hjpjhG+C8Zv
+QiM5uLylD3IPMX9wCz1tAhMNs3v4pEPo/4A//1cdLkor9cQVLFj3+TkS888EWZdj
+Y8mUTIXU6yL1DXcj8CfDPS29fMpDorDpK1swl4pN5qgGfsL5BSAXUf1AZDWbxnEY
+xf5rakfHDzrfbtbTSSfrBxS8gdW2vBKM+3nL21BeP8hQ0tkLA7bn2fNGz3aCOw46
+XeVJdBk1gVTwazspylqrh1ljr0hQEN4gs/8kM645BRdD0IyAFFcI44VmuVwd8+2g
+5miAGmVKSqN77w2cgMRnF7xpUsanv+3zKzaTnG+2liTeCokCPgQTAQIAKAUCVL7V
+IAIbAwUJBaOagAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQD8MELjRa0F1m
+RhAAj9X+/4iiQsN888dNW/H1wEFFTd/1vqb2j0sHP3t02LkEPN5Ii9u71TSD2gSD
+WTu1Eb46nRDcapFNv5M0vXcWrEt7PK9b51Kuj4KpP5IjJHpTl2g7umaYQWC8fqcY
+TJTH0guMSCzZlsP0xGLbAj3cG6X5OPzCO+IxEafXmE//SfS9w46n1OC57ca1Y0Fp
+WXfjA0sJrcozgNchsptu3jg/oEteYJoxDAzNO45O4geNONq5D9PUQPb+H5Vv5zpy
+MI7iUJhVnTOFvnoUgRS7v6pWiA3flh5FelK8tYPCzEfvxfe7EB5GO7MaJEO3ZLni
+COaAZ3Nfn6Tt28tCOgd052W4FeGWow7iYCS1Wgd30bq/FNgnl+tKv2woxmWt4jJv
+ioBHQ4PbUnap2RCmBFaG7llRkrKP8nhWSUdwSS3OmDwAfxTTXjPaESK9EX9OV9Xo
+or07thq+7OMs+2cyiy2jSfIau0SELy/tVioZBhoB7hzAJUB8sGHOxMPlVDFdUr3x
+F/cgCclWANhw2xvgPim1wQ0XpeZe6w9RpmjZR7ReMYwxn8APBDP/e9R5aLDUQAep
+2hrJUPK38D0L69RnpWQsR9hZ2hEOrMV2M6ChlvhwHbGSdJ2CcqG5Jx4ZAP23DK3A
+N26TB88H9F7IMrM0REZeu7KzvYwCWlpg0zMXXKQ/2vovoe2JAlUEEwECAD8CGwMG
+CwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAFiEEtsj5goK5ROOw1cJTD8MELjRa0F0F
+Alpd+i0FCQ8FJo0ACgkQD8MELjRa0F3X3A//dBQLm6GmXlQFjxZbukTw0lZsevFR
+M/6ljZTxp7bsC+HFzYoaCKv6rikaWzytxk//SOaLKrB4Z9HjAlpBMtyLl2Hk7tcZ
+bPpFafNmQ+4KgWNjLXCvt9se8BGrQvGQUrbE6YowbXa2YIgxIVEncFzIECAsp/+N
+xbMcZN5/X1PJxKi/N22gP4nn47muN6L3pKez3CXgWnhGYSc7BuD5ALWYH7yMYUem
+d4jlXfu5xkBIqirj1arIYC9wmF4ldbLNDPuracc8LmXcSqa5Rpao0s4iVzAD+tkX
+vE/73m3rhepwBXxrfk0McXuI9aucf5h4/KkIBzZsaJ6JM1tzlrJzzjaBKJF9OI5T
+jA0qTxdGzdPztS8gPaPcMkRFfh9ti0ZDx4VeF3s8sOtmMRHeGEWfxqUAbBUbwFsa
+JDu/+8/VO4KijfcuUi8tqJ/JHeosCuGE7TM93LwJu6ZcqMYOPDROE/hsnGm0ZU92
+xedu+07/X1ESHkSFPoaSHD5/DCNa/tXIyJZ8X7gF3eoDP5mSmrJqIqsOBR9WOVYv
+dI8i0GHTXbrZj8WXdoS+N8wlyMLLbAS2jvTe7M5RoqbLz4ABOUUnLVoEE0CiccVZ
+bW75BPxOfaD0szbinAeX6HDPI7St0MbKrRPjuDXjD0JVkLqFINtZfYLGMLss4tgn
+suefr0Bo9ISwG3u5Ag0EVL7VIAEQAOxBxrQesChjrCqKjY5PnSsSYpeb4froucrC
+898AFw2DgN/Zz+W7wtSTbtz/GRcCurjzZvN7o2rCuNk0j0+s1sgZZm2BdldlabLy
++UF/kSW1rb5qhfXcGGubu48OMdtSfok9lOc0Q1L4HNlGE4lUBkZzmI7Ykqfl+Bwr
+m9rpi54g4ua9PIiiHIAmMoZIcbtOG1KaDr6CoXRk/3g2ZiGUwhq3jFGroiBsKEap
+2FJ1bh5NJk2Eg8pV7fMOF7hUQKBZrNOtIPu8hA5WEgku3U3VYjRSI3SDi6QXnDL+
+xHxajiWpKtF3JjZh8y/CCTD8PyP34YjfZuFmkdske5cdx6H0V2UCiH453ncgFVdQ
+DXkY4n+0MTzhy2xu0IVVnBxYDYNhi+3MjTHJd9C4xMi9t+5IuEvDAPhgfZjDpQak
+EPz6hVmgj0mlKIgRilBRK9/kOxky9utBpGk3jEJGru/hKNloFNspoYtY6zATAr8E
+cOgoCFQE0nIktcg3wF9+OCEnV28/a7XZwUZ7Gl/qfOHtdr374wo8kd8R3V8d2G9q
+5w0/uCV9NNQ0fGWZDPDoYt6wnPL6gZv/nJM8oZY+u0rC24WwScZIniaryC4JHDas
+Ahr2S2CtgCvBgslK6f3gD16KHxPZMBpX73TzOYIhMEP/vXgVJbUD6dYht+U9c4Oh
+EDJown0dABEBAAGJAjwEGAECACYCGwwWIQS2yPmCgrlE47DVwlMPwwQuNFrQXQUC
+Wl36SwUJDwUmqwAKCRAPwwQuNFrQXT1/D/9YpRDNgaJl3YVDtVZoeQwh7BQ6ULZT
+eXFPogYkF2j3VWg8s9UmAs4sg/4a+9KLSantXjX+JFsRv0lQe5Gr/Vl8VQ4LKEXB
+fiGmSivjIZ7eopdd3YP2w6G5T3SA4d2CQfsg4rnJPnXIjzKNiSOi368ybnt9fL0Y
+2r2aqLTmP6Y7issDUO+J1TW1XHm349JPR0Hl4cTuNnWm4JuX2m2CJEc5XBlDAha9
+pUVs+J5C2D0UFFkyeOzeJPwy6x5ApWHm84n8AjhQSpu1qRKxKXdwei6tkQWWMHui
++TgSY/zCkmD9/oY15Ei5avJ4WgIbTLJUoZMi70riPmU8ThjpzA7S+Nk0g7rMPq+X
+l1whjKU/u0udlsrIJjzkh6ftqKUmIkbxYTpjhnEujNrEr5m2S6Z6x3y9E5QagBMR
+dxRhfk+HbyACcP/p9rXOzl4M291DoKeAAH70GHniGxyNs9rAoMr/hD5XW/Wrz3dc
+KMc2s555E6MZILE2ZiolcRn+bYOMPZtWlbx98t8uqMf49gY4FGQBZAwPglMrx7mr
+m7HTIiXahThQGOJg6izJDAD5RwSEGlAcL28T8KAuM6CLLkhlBfQwiKsUBNnh9r8w
+V3lB+pV0GhL+3i077gTYfZBRwLzjFdhm9xUKEaZ6rN1BX9lzix4eSNK5nln0jUq1
+67H2IH//2sf8dw==
+=fTDu
+-----END PGP PUBLIC KEY BLOCK-----

security/nss/automation/taskcluster/docker-hacl/Dockerfile

@@ -0,0 +1,31 @@
+FROM ubuntu:xenial
+
+MAINTAINER Franziskus Kiefer <franziskuskiefer@gmail.com>
+# Based on the HACL* image from Benjamin Beurdouche and
+# the original F* formula with Daniel Fabian
+
+# Pinned versions of HACL* (F* and KreMLin are pinned as submodules)
+ENV haclrepo https://github.com/mitls/hacl-star.git
+
+# Define versions of dependencies
+ENV opamv 4.05.0
+ENV haclversion 1442c015dab97cdf203ae238b1f3aeccf511bd1e
+
+# Install required packages and set versions
+ADD B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc /tmp/B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc
+ADD setup.sh /tmp/setup.sh
+RUN bash /tmp/setup.sh
+
+# Create user, add scripts.
+RUN useradd -ms /bin/bash worker
+WORKDIR /home/worker
+ADD bin /home/worker/bin
+RUN chmod +x /home/worker/bin/*
+USER worker
+
+# Build F*, HACL*, verify. Install a few more dependencies.
+ENV OPAMYES true
+ENV PATH "/home/worker/hacl-star/dependencies/z3/bin:$PATH"
+ADD setup-user.sh /tmp/setup-user.sh
+ADD license.txt /tmp/license.txt
+RUN bash /tmp/setup-user.sh

security/nss/automation/taskcluster/docker-hacl/bin/checkout.sh

@@ -12,14 +12,9 @@ REVISION=${NSS_HEAD_REVISION:-default}
 REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
 
 # Clone NSS.
-hg clone -r $REVISION $REPOSITORY nss
-
-# Clone NSPR if needed.
-hg clone -r default https://hg.mozilla.org/projects/nspr
-
-if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
-  pushd nspr
-  cat ../nss/nspr.patch | patch -p1
-  popd
-fi
-
+for i in 0 2 5; do
+    sleep $i
+    hg clone -r $REVISION $REPOSITORY nss && exit 0
+    rm -rf nss
+done
+exit 1

security/nss/automation/taskcluster/docker-hacl/license.txt

@@ -0,0 +1,15 @@
+/* Copyright 2016-2017 INRIA and Microsoft Corporation
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+

security/nss/automation/taskcluster/docker-hacl/setup-user.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Prepare build (OCaml packages)
+opam init
+echo ". /home/worker/.opam/opam-init/init.sh > /dev/null 2> /dev/null || true" >> .bashrc
+opam switch -v ${opamv}
+opam install ocamlfind batteries sqlite3 fileutils yojson ppx_deriving_yojson zarith pprint menhir ulex process fix wasm stdint
+
+# Get the HACL* code
+git clone ${haclrepo} hacl-star
+git -C hacl-star checkout ${haclversion}
+
+# Prepare submodules, and build, verify, test, and extract c code
+# This caches the extracted c code (pins the HACL* version). All we need to do
+# on CI now is comparing the code in this docker image with the one in NSS.
+opam config exec -- make -C hacl-star prepare -j$(nproc)
+make -C hacl-star -f Makefile.build snapshots/nss -j$(nproc)
+KOPTS="-funroll-loops 5" make -C hacl-star/code/curve25519 test -j$(nproc)
+make -C hacl-star/code/salsa-family test -j$(nproc)
+make -C hacl-star/code/poly1305 test -j$(nproc)
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache

security/nss/automation/taskcluster/docker-hacl/setup.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Update packages.
+export DEBIAN_FRONTEND=noninteractive
+apt-get -qq update
+apt-get install --yes libssl-dev libsqlite3-dev g++-5 gcc-5 m4 make opam pkg-config python libgmp3-dev cmake curl libtool-bin autoconf wget locales
+update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-5 200
+update-alternatives --install /usr/bin/g++ g++ /usr/bin/g++-5 200
+
+# Get clang-format-3.9
+curl -LO https://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz
+curl -LO https://releases.llvm.org/3.9.1/clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
+
+# Verify the signature. The key used for verification was fetched via:
+#    gpg --keyserver pgp.key-server.io --recv-keys B6C8F98282B944E3B0D5C2530FC3042E345AD05D
+# Use a local copy to workaround bug 1565013.
+gpg --no-default-keyring --keyring tmp.keyring --import /tmp/B6C8F98282B944E3B0D5C2530FC3042E345AD05D.asc
+gpg --no-default-keyring --keyring tmp.keyring --verify clang+llvm-3.9.1-x86_64-linux-gnu-ubuntu-16.04.tar.xz.sig
+
+# Install into /usr/local/.
+tar xJvf *.tar.xz -C /usr/local --strip-components=1
+# Cleanup.
+rm *.tar.xz*
+
+locale-gen en_US.UTF-8
+dpkg-reconfigure locales
+
+# Cleanup.
+rm -rf ~/.ccache ~/.cache
+apt-get autoremove -y
+apt-get clean
+apt-get autoclean

security/nss/automation/taskcluster/docker-interop/Dockerfile

@@ -1,12 +1,11 @@
 # Dockerfile for running interop tests.
 # This includes Rust, golang, and nodejs.
-FROM ubuntu:focal-20221130
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN dpkg --add-architecture i386
-RUN apt-get update && \
-   DEBIAN_FRONTEND=noninteractive \
-   apt-get install -y --no-install-recommends \
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
     build-essential \
     ca-certificates \
     clang \

security/nss/automation/taskcluster/docker-saw/Dockerfile

@@ -0,0 +1,46 @@
+FROM ubuntu:16.04
+MAINTAINER Tim Taubert <ttaubert@mozilla.com>
+
+RUN useradd -d /home/worker -s /bin/bash -m worker
+WORKDIR /home/worker
+
+ENV DEBIAN_FRONTEND noninteractive
+
+RUN apt-get update && apt-get install -y \
+    binutils \
+    build-essential \
+    bzip2 \
+    clang-3.8 \
+    curl \
+    gcc-multilib \
+    g++-multilib \
+    gyp \
+    lib32z1-dev \
+    mercurial \
+    ninja-build \
+    unzip \
+    zlib1g-dev
+
+# Add missing LLVM plugin for gold linker.
+ADD LLVMgold.so.zip /usr/lib/llvm-3.8/lib/LLVMgold.so.zip
+RUN unzip /usr/lib/llvm-3.8/lib/LLVMgold.so.zip -d /usr/lib/llvm-3.8/lib/
+
+# Install SAW/Cryptol.
+RUN curl -LO https://saw.galois.com/builds/nightly/saw-0.2-2018-01-14-Ubuntu14.04-64.tar.gz && \
+    tar xzvf saw-*.tar.gz -C /usr/local --strip-components=1 && \
+    rm saw-*.tar.gz
+
+# Install Z3.
+RUN curl -LO https://github.com/Z3Prover/z3/releases/download/z3-4.6.0/z3-4.6.0-x64-ubuntu-16.04.zip && \
+    unzip z3*.zip && \
+    cp -r z3*/* /usr/local/ && \
+    rm -fr z3*
+
+ADD bin /home/worker/bin
+RUN chmod +x /home/worker/bin/*
+
+# Change user.
+USER worker
+
+# Set a default command useful for debugging
+CMD ["/bin/bash", "--login"]

security/nss/automation/taskcluster/docker-saw/bin/checkout.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+
+set -v -e -x
+
+# Default values for testing.
+REVISION=${NSS_HEAD_REVISION:-default}
+REPOSITORY=${NSS_HEAD_REPOSITORY:-https://hg.mozilla.org/projects/nss}
+
+# Clone NSS.
+for i in 0 2 5; do
+    sleep $i
+    hg clone -r $REVISION $REPOSITORY nss && exit 0
+    rm -rf nss
+done
+exit 1

security/nss/automation/taskcluster/docker/Dockerfile

@@ -1,5 +1,5 @@
 # Lean image for running the bulk of the NSS CI tests on taskcluster.
-FROM ubuntu:bionic-20221215
+FROM ubuntu:18.04
 LABEL maintainer="Martin Thomson <martin.thomson@gmail.com>"
 
 RUN dpkg --add-architecture i386
@@ -20,7 +20,6 @@ RUN apt-get update \
     mercurial \
     ninja-build \
     pkg-config \
-    sqlite3 \
     zlib1g-dev \
  && rm -rf /var/lib/apt/lists/* \
  && apt-get autoremove -y && apt-get clean -y

security/nss/automation/taskcluster/graph/src/extend.js

@@ -20,16 +20,6 @@ const LINUX_INTEROP_IMAGE = {
   path: "automation/taskcluster/docker-interop"
 };
 
-const ACVP_IMAGE = {
-  name: "acvp",
-  path: "automation/taskcluster/docker-acvp"
-};
-
-const ECCKIILA_IMAGE = {
-  name: "ecckiila",
-  path: "automation/taskcluster/docker-ecckiila"
-};
-
 const CLANG_FORMAT_IMAGE = {
   name: "clang-format",
   path: "automation/taskcluster/docker-clang-format"
@@ -51,6 +41,16 @@ const FUZZ_IMAGE_32 = {
   path: "automation/taskcluster/docker-fuzz32"
 };
 
+const HACL_GEN_IMAGE = {
+  name: "hacl",
+  path: "automation/taskcluster/docker-hacl"
+};
+
+const SAW_IMAGE = {
+  name: "saw",
+  path: "automation/taskcluster/docker-saw"
+};
+
 const WINDOWS_CHECKOUT_CMD =
   "bash -c \"hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss || " +
     "(sleep 2; hg clone -r $NSS_HEAD_REVISION $NSS_HEAD_REPOSITORY nss) || " +
@@ -105,20 +105,8 @@ queue.filter(task => {
 
   // Don't run all additional hardware tests on ARM.
   if (task.group == "Cipher" && task.platform == "aarch64" && task.env &&
-      (task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_SSE4_1 == "1"
-       || task.env.NSS_DISABLE_AVX == "1" || task.env.NSS_DISABLE_AVX2 == "1")) {
-    return false;
-  }
-
-  // Don't run ARM specific hardware tests on non-ARM.
-  // TODO: our server that runs task cluster doesn't support Intel SHA extensions.
-  if (task.group == "Cipher" && task.platform != "aarch64" && task.env &&
-      (task.env.NSS_DISABLE_HW_SHA1 == "1" || task.env.NSS_DISABLE_HW_SHA2 == "1")) {
-    return false;
-  }
-
-  // Don't run DBM builds on aarch64.
-  if (task.group == "DBM" && task.platform == "aarch64") {
+      (task.env.NSS_DISABLE_PCLMUL == "1" || task.env.NSS_DISABLE_HW_AES == "1"
+       || task.env.NSS_DISABLE_AVX == "1")) {
     return false;
   }
 
@@ -267,11 +255,6 @@ export default async function main() {
     collection: "debug"
   }, "build_gyp.sh");
 
-  await scheduleWindows("Windows 2012 64 Static (opt)", {
-    platform: "windows2012-64",
-    collection: "opt-static"
-  }, "build_gyp.sh --opt --static");
-
   await scheduleWindows("Windows 2012 32 (opt)", {
     platform: "windows2012-32",
   }, "build_gyp.sh --opt -t ia32");
@@ -329,7 +312,6 @@ export default async function main() {
   );
 
   await scheduleMac("Mac (opt)", {collection: "opt"}, "--opt");
-  await scheduleMac("Mac Static (opt)", {collection: "opt-static"}, "--opt --static -Ddisable_libpkix=1");
   await scheduleMac("Mac (debug)", {collection: "debug"});
 
   // Must be executed after all other tasks are scheduled
@@ -518,7 +500,7 @@ async function scheduleLinux(name, overrides, args = "") {
   }
 
   // The task that generates certificates.
-  let cert_base = merge(build_base, {
+  let task_cert = queue.scheduleTask(merge(build_base, {
     name: "Certificates",
     command: [
       "/bin/bash",
@@ -527,8 +509,7 @@ async function scheduleLinux(name, overrides, args = "") {
     ],
     parent: task_build,
     symbol: "Certs"
-  });
-  let task_cert = queue.scheduleTask(cert_base);
+  }));
 
   // Schedule tests.
   scheduleTests(task_build, task_cert, merge(base, {
@@ -536,9 +517,7 @@ async function scheduleLinux(name, overrides, args = "") {
       "/bin/bash",
       "-c",
       "bin/checkout.sh && nss/automation/taskcluster/scripts/run_tests.sh"
-    ],
-    provisioner: "nss-t",
-    workerType: "t-linux-xlarge-gcp"
+    ]
   }));
 
   // Extra builds.
@@ -554,14 +533,6 @@ async function scheduleLinux(name, overrides, args = "") {
     },
     symbol: "clang-4"
   }));
-  queue.scheduleTask(merge(extra_base, {
-    name: `${name} w/ clang-10`,
-    env: {
-      CC: "clang-10",
-      CCC: "clang++-10",
-    },
-    symbol: "clang-10"
-  }));
   queue.scheduleTask(merge(extra_base, {
     name: `${name} w/ gcc-4.4`,
     image: LINUX_GCC44_IMAGE,
@@ -586,17 +557,8 @@ async function scheduleLinux(name, overrides, args = "") {
     name: `${name} w/ gcc-4.8`,
     env: {
       CC: "gcc-4.8",
-      CCC: "g++-4.8",
-      // gcc-4.8 has incomplete c++11 support
-      NSS_DISABLE_GTESTS: "1",
+      CCC: "g++-4.8"
     },
-    // Use -Ddisable-intelhw_sha=1, GYP doesn't have a proper GCC version
-    // check for Intel SHA support.
-    command: [
-      "/bin/bash",
-      "-c",
-      "bin/checkout.sh && nss/automation/taskcluster/scripts/build.sh",
-    ],
     symbol: "gcc-4.8"
   }));
 
@@ -610,12 +572,12 @@ async function scheduleLinux(name, overrides, args = "") {
   }));
 
   queue.scheduleTask(merge(extra_base, {
-    name: `${name} w/ gcc-11`,
+    name: `${name} w/ gcc-6`,
     env: {
-      CC: "gcc-11",
-      CCC: "g++-11",
+      CC: "gcc-6",
+      CCC: "g++-6"
     },
-    symbol: "gcc-11"
+    symbol: "gcc-6"
   }));
 
   queue.scheduleTask(merge(extra_base, {
@@ -630,25 +592,6 @@ async function scheduleLinux(name, overrides, args = "") {
     symbol: "modular"
   }));
 
-  if (base.collection != "make") {
-    let task_build_dbm = queue.scheduleTask(merge(extra_base, {
-      name: `${name} w/ legacy-db`,
-      command: [
-        "/bin/bash",
-        "-c",
-        checkout_and_gyp + "--enable-legacy-db"
-      ],
-      symbol: "B",
-      group: "DBM",
-    }));
-
-    let task_cert_dbm = queue.scheduleTask(merge(cert_base, {
-      parent: task_build_dbm,
-      group: "DBM",
-      symbol: "Certs"
-    }));
-  }
-
   return queue.submit();
 }
 
@@ -667,8 +610,6 @@ function scheduleFuzzingRun(base, name, target, max_len, symbol = null, corpus =
         `-max_total_time=${MAX_FUZZ_TIME} ` +
         `-max_len=${max_len}`
     ],
-    provisioner: "nss-t",
-    workerType: "t-linux-xlarge-gcp",
     symbol: symbol || name
   }));
 }
@@ -886,14 +827,14 @@ async function scheduleFuzzing32() {
 
 async function scheduleWindows(name, base, build_script) {
   base = merge(base, {
-    workerType: "b-win2012-azure",
+    workerType: "win2012r2",
     env: {
       PATH: "c:\\mozilla-build\\bin;c:\\mozilla-build\\python;" +
-           "c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;" +
-           "c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;" +
-           "c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;" +
-           "c:\\Windows\\system32;c:\\mozilla-build\\upx391w;" +
-           "c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget;c:\\Program Files\\Mercurial",
+	    "c:\\mozilla-build\\msys\\local\\bin;c:\\mozilla-build\\7zip;" +
+	    "c:\\mozilla-build\\info-zip;c:\\mozilla-build\\python\\Scripts;" +
+	    "c:\\mozilla-build\\yasm;c:\\mozilla-build\\msys\\bin;" +
+	    "c:\\Windows\\system32;c:\\mozilla-build\\upx391w;" +
+	    "c:\\mozilla-build\\moztools-x64\\bin;c:\\mozilla-build\\wget",
       DOMSUF: "localdomain",
       HOST: "localhost",
     },
@@ -1042,16 +983,9 @@ function scheduleTests(task_build, task_cert, test_base) {
     name: "Cipher tests", symbol: "Default", tests: "cipher", group: "Cipher"
   }));
   queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoAES", tests: "cipher",
+    name: "Cipher tests", symbol: "NoAESNI", tests: "cipher",
     env: {NSS_DISABLE_HW_AES: "1"}, group: "Cipher"
   }));
-  queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoSHA", tests: "cipher",
-    env: {
-      NSS_DISABLE_HW_SHA1: "1",
-      NSS_DISABLE_HW_SHA2: "1"
-    }, group: "Cipher"
-  }));
   queue.scheduleTask(merge(cert_base_long, {
     name: "Cipher tests", symbol: "NoPCLMUL", tests: "cipher",
     env: {NSS_DISABLE_PCLMUL: "1"}, group: "Cipher"
@@ -1060,10 +994,6 @@ function scheduleTests(task_build, task_cert, test_base) {
     name: "Cipher tests", symbol: "NoAVX", tests: "cipher",
     env: {NSS_DISABLE_AVX: "1"}, group: "Cipher"
   }));
-  queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoAVX2", tests: "cipher",
-    env: {NSS_DISABLE_AVX2: "1"}, group: "Cipher"
-  }));
   queue.scheduleTask(merge(cert_base_long, {
     name: "Cipher tests", symbol: "NoSSSE3|NEON", tests: "cipher",
     env: {
@@ -1071,10 +1001,6 @@ function scheduleTests(task_build, task_cert, test_base) {
       NSS_DISABLE_SSSE3: "1"
     }, group: "Cipher"
   }));
-  queue.scheduleTask(merge(cert_base_long, {
-    name: "Cipher tests", symbol: "NoSSE4.1", tests: "cipher",
-    env: {NSS_DISABLE_SSE4_1: "1"}, group: "Cipher"
-  }));
   queue.scheduleTask(merge(cert_base, {
     name: "EC tests", symbol: "EC", tests: "ec"
   }));
@@ -1113,6 +1039,12 @@ function scheduleTests(task_build, task_cert, test_base) {
   queue.scheduleTask(merge(ssl_base, {
     name: "SSL tests (pkix)", symbol: "pkix", cycle: "pkix"
   }));
+  queue.scheduleTask(merge(ssl_base, {
+    name: "SSL tests (sharedb)", symbol: "sharedb", cycle: "sharedb"
+  }));
+  queue.scheduleTask(merge(ssl_base, {
+    name: "SSL tests (upgradedb)", symbol: "upgradedb", cycle: "upgradedb"
+  }));
   queue.scheduleTask(merge(ssl_base, {
     name: "SSL tests (stress)", symbol: "stress", cycle: "sharedb",
     env: {NSS_SSL_RUN: "stress"}
@@ -1150,18 +1082,6 @@ async function scheduleTools() {
     ]
   }));
 
-  queue.scheduleTask(merge(base, {
-    symbol: "acvp",
-    name: "acvp",
-    image: ACVP_IMAGE,
-    command: [
-      "/bin/bash",
-      "-c",
-      "bin/checkout.sh && bin/run.sh"
-    ]
-  }));
-
-
   queue.scheduleTask(merge(base, {
     symbol: "scan-build",
     name: "scan-build",
@@ -1185,34 +1105,55 @@ async function scheduleTools() {
     ]
   }));
 
+  queue.scheduleTask(merge(base, {
+    symbol: "coverity",
+    name: "coverity",
+    image: FUZZ_IMAGE,
+    tags: ['code-review'],
+    env: {
+      USE_64: "1",
+      CC: "clang",
+      CCC: "clang++",
+      NSS_AUTOMATION: "1"
+    },
+    features: ["taskclusterProxy"],
+    scopes: ["secrets:get:project/relman/coverity-nss"],
+    artifacts: {
+      "public/code-review/coverity.json": {
+        expires: 24 * 7,
+        type: "file",
+        path: "/home/worker/nss/coverity/coverity.json"
+      }
+    },
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_coverity.sh"
+    ]
+  }));
+
   queue.scheduleTask(merge(base, {
     symbol: "hacl",
     name: "hacl",
-    image: LINUX_BUILDS_IMAGE,
+    image: HACL_GEN_IMAGE,
     command: [
       "/bin/bash",
       "-c",
       "bin/checkout.sh && nss/automation/taskcluster/scripts/run_hacl.sh"
     ]
   }));
-  
-  queue.scheduleTask(merge(base, {
-    symbol: "ecckiila",
-    name: "ecckiila",
-    image: ECCKIILA_IMAGE,
-    command: [
-      "/bin/bash",
-      "-c",
-      "bin/checkout.sh && bin/ecckiila.sh && bin/run.sh"
-    ]
-  }));
 
-  queue.scheduleTask(merge(base, {
-    symbol: "Coverage",
-    name: "Coverage",
-    image: FUZZ_IMAGE,
-    type: "other",
-    features: ["allowPtrace"],
+  let task_saw = queue.scheduleTask(merge(base, {
+    symbol: "B",
+    group: "SAW",
+    name: "LLVM bitcode build (32 bit)",
+    image: SAW_IMAGE,
+    kind: "build",
+    env: {
+      AR: "llvm-ar-3.8",
+      CC: "clang-3.8",
+      CCC: "clang++-3.8"
+    },
     artifacts: {
       public: {
         expires: 24 * 7,
@@ -1220,6 +1161,57 @@ async function scheduleTools() {
         path: "/home/worker/artifacts"
       }
     },
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/build_gyp.sh --disable-tests --emit-llvm -t ia32"
+    ]
+  }));
+
+  queue.scheduleTask(merge(base, {
+    parent: task_saw,
+    symbol: "bmul",
+    group: "SAW",
+    name: "bmul.saw",
+    image: SAW_IMAGE,
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh bmul"
+    ]
+  }));
+
+  queue.scheduleTask(merge(base, {
+    parent: task_saw,
+    symbol: "ChaCha20",
+    group: "SAW",
+    name: "chacha20.saw",
+    image: SAW_IMAGE,
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh chacha20"
+    ]
+  }));
+
+  queue.scheduleTask(merge(base, {
+    parent: task_saw,
+    symbol: "Poly1305",
+    group: "SAW",
+    name: "poly1305.saw",
+    image: SAW_IMAGE,
+    command: [
+      "/bin/bash",
+      "-c",
+      "bin/checkout.sh && nss/automation/taskcluster/scripts/run_saw.sh poly1305"
+    ]
+  }));
+
+  queue.scheduleTask(merge(base, {
+    symbol: "Coverage",
+    name: "Coverage",
+    image: FUZZ_IMAGE,
+    features: ["allowPtrace"],
     command: [
       "/bin/bash",
       "-c",

security/nss/automation/taskcluster/graph/src/image_builder.js

@@ -9,7 +9,7 @@ import taskcluster from "taskcluster-client";
 async function taskHasImageArtifact(taskId) {
   let queue = new taskcluster.Queue(taskcluster.fromEnvVars());
   let {artifacts} = await queue.listLatestArtifacts(taskId);
-  return artifacts.some(artifact => artifact.name == "public/image.tar.zst");
+  return artifacts.some(artifact => artifact.name == "public/image.tar");
 }
 
 async function findTaskWithImageArtifact(ns) {
@@ -41,10 +41,10 @@ export async function buildTask({name, path}) {
       HASH: hash
     },
     artifacts: {
-      "public/image.tar.zst": {
+      "public/image.tar": {
         type: "file",
         expires: 24 * 90,
-        path: "/artifacts/image.tar.zst"
+        path: "/artifacts/image.tar"
       }
     },
     command: [
@@ -56,6 +56,6 @@ export async function buildTask({name, path}) {
     features: ["dind"],
     maxRunTime: 7200,
     kind: "build",
-    symbol: `I(${name})`
+    symbol: "I"
   };
 }

security/nss/automation/taskcluster/graph/src/index.js

@@ -10,6 +10,12 @@ const main = async () => {
   // Init try syntax filter.
   if (process.env.TC_PROJECT == "nss-try") {
     await try_syntax.initFilter();
+  } else {
+    // Coverity should not be run on landings, only by request (typically
+    // by Phabricator).
+    queue.filter(task => {
+      return task.symbol != "coverity";
+    });
   }
 
   // Extend the task graph.

security/nss/automation/taskcluster/graph/src/queue.js

@@ -157,7 +157,7 @@ function convertTask(def) {
 
   return {
     provisionerId: def.provisioner || `nss-${process.env.MOZ_SCM_LEVEL}`,
-    workerType: def.workerType || "linux-gcp",
+    workerType: def.workerType || "linux",
     schedulerId: process.env.TC_SCHEDULER_ID,
     taskGroupId: process.env.TASK_ID,
 
@@ -220,9 +220,6 @@ export async function submit() {
     maps.forEach(map => { task = map(merge({}, task)) });
 
     let log_id = `${task.name} @ ${task.platform}[${task.collection || "opt"}]`;
-    if (task.group) {
-      log_id = `${task.group}::${log_id}`;
-    }
     console.log(`+ Submitting ${log_id}.`);
 
     // Index that task for each tag specified
@@ -277,7 +274,7 @@ export async function submit() {
       }
 
       task.payload.image = {
-        path: "public/image.tar.zst",
+        path: "public/image.tar",
         taskId: data.taskId,
         type: "task-image"
       };

security/nss/automation/taskcluster/graph/src/try_syntax.js

@@ -31,7 +31,7 @@ function parseOptions(opts) {
   let allPlatforms = ["linux", "linux64", "linux64-asan", "linux64-fips",
                       "win", "win64", "win-make", "win64-make",
                       "linux64-make", "linux-make", "linux-fuzz",
-                      "linux64-fuzz", "aarch64", "aarch64-make", "mac"];
+                      "linux64-fuzz", "aarch64", "mac"];
   let platforms = intersect(opts.platform.split(/\s*,\s*/), allPlatforms);
 
   // If the given value is nonsense or "none" default to all platforms.
@@ -57,7 +57,7 @@ function parseOptions(opts) {
   }
 
   // Parse tools.
-  let allTools = ["clang-format", "scan-build", "hacl", "ecckiila", "saw", "abi", "coverage"];
+  let allTools = ["clang-format", "scan-build", "coverity", "hacl", "saw", "abi", "coverage"];
   let tools = intersect(opts.tools.split(/\s*,\s*/), allTools);
 
   // If the given value is "all" run all tools.
@@ -115,7 +115,6 @@ function filter(opts) {
     // Filter by platform.
     let found = opts.platforms.some(platform => {
       let aliases = {
-        "aarch64-make": "aarch64",
         "linux": "linux32",
         "linux-fuzz": "linux32",
         "linux64-asan": "linux64",
@@ -138,8 +137,7 @@ function filter(opts) {
       } else if (platform == "linux64-fips") {
         keep &= coll("fips");
       } else if (platform == "linux64-make" || platform == "linux-make" ||
-                 platform == "win64-make" || platform == "win-make" ||
-                 platform == "aarch64-make") {
+                 platform == "win64-make" || platform == "win-make") {
         keep &= coll("make");
       } else if (platform == "linux64-fuzz" || platform == "linux-fuzz") {
         keep &= coll("fuzz");

security/nss/automation/taskcluster/scripts/build_gyp.sh

@@ -12,7 +12,7 @@ if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
 fi
 
 # Build.
-nss/build.sh -g -v --enable-libpkix -Denable_draft_hpke=1 "$@"
+nss/build.sh -g -v --enable-libpkix "$@"
 
 # Package.
 if [[ $(uname) = "Darwin" ]]; then

security/nss/automation/taskcluster/scripts/build_image.sh

@@ -18,10 +18,7 @@ CONTEXT_PATH="/home/worker/nss/$CONTEXT_PATH"
 test -d "$CONTEXT_PATH" || raise_error "Context Path $CONTEXT_PATH does not exist."
 test -f "$CONTEXT_PATH/Dockerfile" || raise_error "Dockerfile must be present in $CONTEXT_PATH."
 
-apt-get update
-apt-get -y install zstd
-
 docker build -t "$PROJECT:$HASH" "$CONTEXT_PATH"
 
 mkdir /artifacts
-docker save "$PROJECT:$HASH" | zstd > /artifacts/image.tar.zst
+docker save "$PROJECT:$HASH" > /artifacts/image.tar

security/nss/automation/taskcluster/scripts/check_abi.sh

@@ -89,7 +89,7 @@ check_abi()
   abi_diff
 }
 
-#Slightly modified from build.sh in this directory
+#Slightly modified from builbot-slave/build.sh
 abi_diff()
 {
   ABI_PROBLEM_FOUND=0
@@ -97,8 +97,7 @@ abi_diff()
   rm -f ${ABI_REPORT}
   PREVDIST=${HGDIR}/baseline/dist
   NEWDIST=${HGDIR}/dist
-  # libnssdbm3.so isn't built by default anymore, skip it.
-  ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
+  ALL_SOs="libfreebl3.so libfreeblpriv3.so libnspr4.so libnss3.so libnssckbi.so libnssdbm3.so libnsssysinit.so libnssutil3.so libplc4.so libplds4.so libsmime3.so libsoftokn3.so libssl3.so"
   for SO in ${ALL_SOs}; do
       if [ ! -f ${HGDIR}/nss/automation/abi-check/expected-report-$SO.txt ]; then
           touch ${HGDIR}/nss/automation/abi-check/expected-report-$SO.txt
@@ -123,7 +122,7 @@ abi_diff()
       # If abidiff reports an error, or a usage error, or if it sets a result
       # bit value this script doesn't know yet about, we'll report failure.
       # For ABI changes, we don't yet report an error. We'll compare the
-      # result report with our allowlist. This allows us to silence changes
+      # result report with our whitelist. This allows us to silence changes
       # that we're already aware of and have been declared acceptable.
 
       REPORT_RET_AS_FAILURE=0
@@ -141,10 +140,10 @@ abi_diff()
       fi
 
       if [ $ABIDIFF_ABI_CHANGE -ne 0 ]; then
-          echo "Ignoring abidiff result ABI_CHANGE, instead we'll check for non-allowlisted differences."
+          echo "Ignoring abidiff result ABI_CHANGE, instead we'll check for non-whitelisted differences."
       fi
       if [ $ABIDIFF_ABI_INCOMPATIBLE_CHANGE -ne 0 ]; then
-          echo "Ignoring abidiff result ABIDIFF_ABI_INCOMPATIBLE_CHANGE, instead we'll check for non-allowlisted differences."
+          echo "Ignoring abidiff result ABIDIFF_ABI_INCOMPATIBLE_CHANGE, instead we'll check for non-whitelisted differences."
       fi
 
       if [ $REPORT_RET_AS_FAILURE -ne 0 ]; then

security/nss/automation/taskcluster/scripts/run_coverity.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+source $(dirname "$0")/tools.sh
+
+# Clone NSPR if needed.
+if [ ! -d "nspr" ]; then
+    hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
+
+  if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
+    pushd nspr
+    cat ../nss/nspr.patch | patch -p1
+    popd
+  fi
+fi
+
+# Build and run Coverity
+cd nss
+./mach static-analysis
+
+# Return the exit code of the Coverity Analysis
+exit $?

security/nss/automation/taskcluster/scripts/run_hacl.sh

@@ -8,37 +8,33 @@ fi
 
 set -e -x -v
 
-# The docker image this is running in has NSS sources.
-# Get the HACL* source, containing a snapshot of the C code, extracted on the
-# HACL CI.
-git clone -q "https://github.com/hacl-star/hacl-star" ~/hacl-star
-git -C ~/hacl-star checkout -q 51a72a953a4ee6f91e63b2816ae5c4e62edf35d6
+# The docker image this is running in has the HACL* and NSS sources.
+# The extracted C code from HACL* is already generated and the HACL* tests were
+# successfully executed.
 
-# Format the C snapshot.
-cd ~/hacl-star/dist/mozilla
-cp ~/nss/.clang-format .
-find . -type f -name '*.[ch]' -exec clang-format -i {} \+
-cd ~/hacl-star/dist/karamel
+# Verify HACL*. Taskcluster fails when we do this in the image build.
+make -C hacl-star verify-nss -j$(nproc)
+
+# Add license header to specs
+spec_files=($(find ~/hacl-star/specs -type f -name '*.fst'))
+for f in "${spec_files[@]}"; do
+    cat /tmp/license.txt "$f" > /tmp/tmpfile && mv /tmp/tmpfile "$f"
+done
+
+# Format the extracted C code.
+cd ~/hacl-star/snapshots/nss
 cp ~/nss/.clang-format .
 find . -type f -name '*.[ch]' -exec clang-format -i {} \+
 
 # These diff commands will return 1 if there are differences and stop the script.
-
-# We have two checks in the script. 
-# The first one only checks the files in the verified/internal folder; the second one does for all the rest
-# It was implemented like this due to not uniqueness of the names in the verified folders
-# For instance, the files Hacl_Chacha20.h are present in both directories, but the content differs.
-
-files=($(find ~/nss/lib/freebl/verified/internal -type f -name '*.[ch]'))
+files=($(find ~/nss/lib/freebl/verified/ -type f -name '*.[ch]'))
 for f in "${files[@]}"; do
-    file_name=$(basename "$f")
-    hacl_file=($(find ~/hacl-star/dist/mozilla/internal/ -type f -name $file_name))
-    diff $hacl_file $f
+    diff $f $(basename "$f")
 done
 
-files=($(find ~/nss/lib/freebl/verified/ -type f -name '*.[ch]' -not -path "*/freebl/verified/internal/*" -not -path "*/freebl/verified/config.h"))
+# Check that the specs didn't change either.
+cd ~/hacl-star/specs
+files=($(find ~/nss/lib/freebl/verified/specs -type f))
 for f in "${files[@]}"; do
-    file_name=$(basename "$f")
-    hacl_file=($(find ~/hacl-star/dist/mozilla/ ~/hacl-star/dist/karamel/ -type f -name $file_name -not -path "*/hacl-star/dist/mozilla/internal/*"))
-    diff $hacl_file $f
+    diff $f $(basename "$f")
 done

security/nss/automation/taskcluster/scripts/run_saw.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+source $(dirname "$0")/tools.sh
+
+# Fetch artifact if needed.
+fetch_dist
+
+# Run SAW.
+saw "nss/automation/saw/$1.saw"

security/nss/automation/taskcluster/scripts/split.sh

@@ -39,6 +39,7 @@ split_util() {
   # Copy some files at the top and the util subdirectory recursively.
   mkdir $dstdir/lib
   cp $nssdir/lib/Makefile $dstdir/lib
+  cp $nssdir/lib/manifest.mn $dstdir/lib
   cp -R $nssdir/lib/util $dstdir/lib/util
 }
 

security/nss/automation/taskcluster/windows/build_gyp.sh

@@ -38,7 +38,7 @@ if [[ -f nss/nspr.patch && "$ALLOW_NSPR_PATCH" == "1" ]]; then
 fi
 
 # Build with gyp.
-./nss/build.sh -g -v --enable-libpkix -Denable_draft_hpke=1 "$@"
+./nss/build.sh -g -v --enable-libpkix "$@"
 
 # Package.
 7z a public/build/dist.7z dist