dev-libs/nss: Add patch to prefer writable tokens for trust
Adds a patch to NSS which makes NSS prefer a writable token that already
contains the certificate when looking for a token that should be used to
store trust settings for a certificate.
This avoids the situation where if the token that already has trust
settings is read-only, NSS uses a fall-back logic to just select the
first writable token.
Contains exactly the non-test changes from
https://phabricator.services.mozilla.com/D99840
BUG=b/211098383
TEST=modifying trust through chrome://settings/certificates works,
also with built-in certs after CL:2561386 and CL:2567878
RELEASE_NOTE=None
cos-patch: security-high
Change-Id: I0940cd0de4655020cb9027b33e585022762d423c
Reviewed-on: https://cos-review.googlesource.com/c/third_party/overlays/chromiumos-overlay/+/26806
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Reviewed-by: Meena Shanmugam <meenashanmugam@google.com>
4 files changed
