net: make pinning enforcement timeout after ten weeks.

net: make pinning enforcement timeout after ten weeks.

Some users fall off the update train. We don't want to build up a non-trival
population of people who have pins that we might want to change.

BUG=103283
TEST=Check that https://pinningtest.appspot.com fails in official builds.

[wtc, 2011-11-08 19:43:40]

Review comments on Patch Set 1:

I think GetDaysSinceBuild() should be in src/base.  I also
suspect such a function already exists.  I asked around and
mal pointed me to jar and his metrics code.  A search in the
Chromium source tree for "BuildTime" found:

$ find . -name "*.h" | xargs grep BuildTime
./base/metrics/field_trial.h:  static Time GetBuildTime();
./chrome/common/pref_names.h:extern const char kStabilityStatsBuildTime[];
./chrome/common/metrics_helpers.h:  static int64 GetBuildTime();

We should try to share that function.

http://codereview.chromium.org/8467031/diff/1/net/base/build_time.cc
File net/base/build_time.cc (right):

http://codereview.chromium.org/8467031/diff/1/net/base/build_time.cc#newcode17
net/base/build_time.cc:17: // It is exactly "Mth DD YYYY".

Nit: Mth => Mmm ?

Mth seems to suggest that we should say "5th" for May.
(I guess "Mth" is short for "Month".)

http://codereview.chromium.org/8467031/diff/1/net/base/build_time.cc#newcode28
net/base/build_time.cc:28: build_date[6] = 0;

Nit: use '\0' instead of 0 in these two assignments.

http://codereview.chromium.org/8467031/diff/1/net/base/build_time.h
File net/base/build_time.h (right):

http://codereview.chromium.org/8467031/diff/1/net/base/build_time.h#newcode18
net/base/build_time.h:18: int NET_EXPORT GetDaysSinceBuild();

This function should be in src/base.  I am a little surprised
that we don't have such a function.

It seems that returning the build time as a base::Time would
make the function more flexible.

[wtc, 2011-11-08 19:55:52]

agl: I talked to jar about this.  He recommend two things.

1. Use the GetBuildTime function in base/metrics/field_trial.h.
That is a private method right now, so we'll need to make it
public.

2. Instead of using a moving deadline (10 weeks after build
time), jar suggested that we use an absolute deadline.  This
way, if someone builds an old build in the future, those
certificate public key pins will be expired properly.

This sounds good to me, but it is a burden to maintain the
absolute deadline in the source file, so I am not sure if
you should do that...

[agl, 2011-11-11 16:49:41]

PTAL.

I followed up with jar to expose GetBuildTime from base.

Although I understand the benefits of having a fixed date, I don't want to add
the maintenance burden, so I've retained the relative time limit.

[wtc, 2011-11-15 02:49:30]

LGTM.

http://codereview.chromium.org/8467031/diff/4001/net/url_request/url_request_...
File net/url_request/url_request_http_job.cc (right):

http://codereview.chromium.org/8467031/diff/4001/net/url_request/url_request_...
net/url_request/url_request_http_job.cc:690: if ((base::Time::Now() -
build_time).InDays() < 70 /* 10 weeks */) {

Please add a comment to explain the purpose of this test.
It is not obvious.