Bug 1780787 - signingscript: remove digicerthack

[jcristau]

DigiCert's timestamp server now includes an intermediate in its response that serves our purposes (chains to a root that's included in Windows 7), so we don't need to mess with the certificates ourselves anymore.

[JohanLorenzo]

This looks good to me based on the fact that we're just reverting commits and based on the thorough explanation in bug 1780787 comment 1.

Do we have a way to test this on try and nightly first? If we could make this change ride the trains, that would give us some leeway to ensure the timing is right and we don't break anything. That said, I'm not going to block on this 🙂

[jcristau]

This looks good to me based on the fact that we're just reverting commits and based on the thorough explanation in bug 1780787 comment 1.

Do we have a way to test this on try and nightly first? If we could make this change ride the trains, that would give us some leeway to ensure the timing is right and we don't break anything. That said, I'm not going to block on this slightly_smiling_face

There's a few things we could do. Off the top of my head:

• turn off the hack for adhoc, get a binary signed that way, and test it, before we remove the code
• add a "turn off the hack for me please" param in the task payload, and land a patch in-tree to set it, so it can ride the trains; once we're happy we can remove the code and ignore the flag
• turn off the hack for nightly and dep signing, and test on nightly, before we remove the code

It all depends on the amount of effort we want to spend vs the risk. I'm reasonably comfortable landing this directly after the checks I've done, but I could be convinced to go for a more cautious approach.

[JohanLorenzo]

Thanks for thinking these options through, @jcristau! To me, the third one is the most pragmatic. We can test this on the Nightly population without landing many patches in various places.

[jcristau]

Thanks for thinking these options through, @jcristau! To me, the third one is the most pragmatic. We can test this on the Nightly population without landing many patches in various places.

Cool. Doing this in #588