tree adc7b314b8ced67526cd14bfad29414fbfe3f41f
parent 1589e3bd1c5da74bf79edca503003db6d9b8a63e
author Pavol Marko <pmarko@google.com> 1606398422 +0100
committer Oleksandr Tymoshenko <ovt@google.com> 1640727386 +0000

dev-libs/nss: Add patch to prefer writable tokens for trust

Adds a patch to NSS which makes NSS prefer a writable token that already
contains the certificate when looking for a token that should be used to
store trust settings for a certificate.

This avoids the situation where if the token that already has trust
settings is read-only, NSS uses a fall-back logic to just select the
first writable token.

Contains exactly the non-test changes from
https://phabricator.services.mozilla.com/D99840

BUG=b/211098383
TEST=modifying trust through chrome://settings/certificates works,
also with built-in certs after CL:2561386 and CL:2567878
RELEASE_NOTE=None

cos-patch: security-high
Change-Id: I0940cd0de4655020cb9027b33e585022762d423c
Reviewed-on: https://cos-review.googlesource.com/c/third_party/overlays/chromiumos-overlay/+/26806
Main-Branch-Verified: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
Reviewed-by: Meena Shanmugam <meenashanmugam@google.com>