Update NSS to 3.38

- Added HACL*Poly1305 32-bit (INRIA/Microsoft)
- Updated to final TLS 1.3 draft version (28)
- Removed TLS 1.3 prerelease draft limit check
- Removed NPN code
- Enabled dev/urandom-only RNG on Linux with NSS_SEED_ONLY_DEV_URANDOM for non-standard environments
- Fixed several bugs with TLS 1.3 negotiation
- Updated internal certificate store
- Added support for the TLS Record Size Limit Extension.
- Fixed CVE-2018-0495
- Various security fixes in the ASN.1 code.

security/nss/automation/taskcluster/scripts/gen_coverage_report.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+source $(dirname "$0")/tools.sh
+
+# Clone NSPR.
+hg_clone https://hg.mozilla.org/projects/nspr ./nspr default
+
+out=/home/worker/artifacts
+mkdir -p $out
+
+# Generate coverage report.
+cd nss && ./mach coverage --outdir=$out ssl_gtests

security/nss/automation/taskcluster/scripts/run_hacl.sh

@@ -12,8 +12,8 @@ set -e -x -v
 # The extracted C code from HACL* is already generated and the HACL* tests were
 # successfully executed.
 
-# Verify Poly1305 (doesn't work in docker image build)
-make verify -C ~/hacl-star/code/poly1305 -j$(nproc)
+# Verify HACL*. Taskcluster fails when we do this in the image build.
+make -C hacl-star verify-nss -j$(nproc)
 
 # Add license header to specs
 spec_files=($(find ~/hacl-star/specs -type f -name '*.fst'))

security/nss/automation/taskcluster/scripts/tools.sh

@@ -3,11 +3,16 @@
 set -v -e -x
 
 if [[ $(id -u) -eq 0 ]]; then
+    # Stupid Docker. It works without sometimes... But not always.
+    echo "127.0.0.1 localhost.localdomain" >> /etc/hosts
+
     # Drop privileges by re-running this script.
     # Note: this mangles arguments, better to avoid running scripts as root.
     exec su worker -c "$0 $*"
 fi
 
+export PATH="${PATH}:/home/worker/.cargo/bin/:/usr/lib/go-1.6/bin"
+
 # Usage: hg_clone repo dir [revision=@]
 hg_clone() {
     repo=$1