Mar Notes

MAR Signing

MAR File location

Example https://archive.mozilla.org/pub/firefox/releases/59.0.2/update/win64/en-US/firefox-59.0.2.complete.mar

Existing tooling

• various per-platform binaries in tree (but not using)
• mozilla/build-mar <= choosen tool - Python 2.7 & 3

build-mar on Ubuntu

• need to install liblzma-dev first for header files.

build-mar usage

• need production public certs (see below)
• need to extract public key from cert: openssl x509 -pubkey -noout -inform der -in {cert}.der >{cert}.key
• cli operation: mar -k {cert}.key -v {file}.mar with returncode of 0 or 1 (which may include traceback)
• TO DO: library operation next to be investigated.

Code extracts

From moz.build which key is used:

Valid Signature Selection

if CONFIG['MOZ_UPDATE_CHANNEL'] in ('beta', 'release', 'esr'):
    primary_cert.inputs += ['release_primary.der']
    secondary_cert.inputs += ['release_secondary.der']
elif CONFIG['MOZ_UPDATE_CHANNEL'] in ('nightly', 'aurora', 'nightly-elm',
                                      'nightly-profiling', 'nightly-oak',
                                      'nightly-ux'):
    primary_cert.inputs += ['nightly_aurora_level3_primary.der']
    secondary_cert.inputs += ['nightly_aurora_level3_secondary.der']
else:
    primary_cert.inputs += ['dep1.der']
secondary_cert.inputs += ['dep2.der']

In tree DER Files:

dep1.der
dep2.der
nightly_aurora_level3_primary.der
nightly_aurora_level3_secondary.der
release_primary.der
release_secondary.der

Can be retrieved from https://github.com/mozilla/gecko-dev/raw/master/toolkit/mozapps/update/updater/{file}