Replaced boto certificate

Replaced boto certificate

Removed check on certificate SHA1 in gsutil

BUG=348233
Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=260297

[pgervais, 2014-03-27 01:05:25]

New attempt to update the boto certificate. This CL removes the checks that are
performed in gsutil on the SHA1 of the certificate.

[Ryan Tseng, 2014-03-27 01:08:08]

Also change third_party/gsutil/README.chromium

[pgervais, 2014-03-27 01:14:30]

On 2014/03/27 01:08:08, Ryan T. wrote:
> Also change third_party/gsutil/README.chromium

Done

[Ryan Tseng, 2014-03-27 01:17:10]

lgtm % nit

https://codereview.chromium.org/212553007/diff/20001/third_party/gsutil/READM...
File third_party/gsutil/README.chromium (right):

https://codereview.chromium.org/212553007/diff/20001/third_party/gsutil/READM...
third_party/gsutil/README.chromium:17: * Removed certificate SHA1 check
nit: Removed oauth2_client certificate SHA1 check

Just so we know which certificate we're talking about.

[pgervais, 2014-03-27 01:20:22]

On 2014/03/27 01:17:10, Ryan T. wrote:
> lgtm % nit
> 
>
https://codereview.chromium.org/212553007/diff/20001/third_party/gsutil/READM...
> File third_party/gsutil/README.chromium (right):
> 
>
https://codereview.chromium.org/212553007/diff/20001/third_party/gsutil/READM...
> third_party/gsutil/README.chromium:17: * Removed certificate SHA1 check
> nit: Removed oauth2_client certificate SHA1 check
> 
> Just so we know which certificate we're talking about.

Done

[pgervais, 2014-03-27 22:19:12]

The CQ bit was checked by pgervais@chromium.org

[commit-bot: I haz the power, 2014-03-27 22:19:19]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/pgervais@chromium.org/212553007/40001

[commit-bot: I haz the power, 2014-03-27 22:21:12]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-03-27 22:21:13]

Presubmit check for 212553007-40001 failed and returned exit status 1.

Running presubmit commit checks ...
Checking out rietveld...
Running save-description-on-failure.sh
Running push-basic.sh
Running upstream.sh
Running submit-from-new-dir.sh
Running abandon.sh
Running submodule-merge-test.sh
Running upload-local-tracking-branch.sh
Running hooks.sh
Running post-dcommit-hook-test.sh
Running upload-stale.sh
Running patch.sh
Running basic.sh

** Presubmit ERRORS **
Missing LGTM from an OWNER for these files:
    depot_tools/third_party/boto/README.chromium
    depot_tools/third_party/boto/cacerts/cacerts.txt
    depot_tools/third_party/gsutil/README.chromium
    depot_tools/third_party/gsutil/oauth2_plugin/oauth2_client.py

Presubmit checks took 97.9s to calculate.

[pgervais, 2014-03-27 22:23:26]

Can any of stip@ or maruel@ (rs)lgtm this?

[ghost stip (do not use), 2014-03-28 21:17:02]

lgtm with change.

I verified that the cacerts.txt as of patchset 3 has the same sha256 as
https://pki.google.com/roots.pem:
6ae824387b0f967a07e0b4bf7a030a72962ee141f09da0591927230e3c37d160

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/boto/...
File third_party/boto/README.chromium (right):

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/boto/...
third_party/boto/README.chromium:39: * Replaced boto/cacerts/cacerts.txt by file
from http://pki.google.com/roots.pem
you meant https://, right?

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
File third_party/gsutil/oauth2_plugin/oauth2_client.py (left):

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
third_party/gsutil/oauth2_plugin/oauth2_client.py:69: CACERTS_FILE_SHA1SUM =
'ed024a78d9327f8669b3b117d9eac9e3c9460e9b'
instead of removing, shouldn't we just switch it to the modified sha?

[Ryan Tseng, 2014-03-28 21:32:35]

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
File third_party/gsutil/oauth2_plugin/oauth2_client.py (left):

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
third_party/gsutil/oauth2_plugin/oauth2_client.py:69: CACERTS_FILE_SHA1SUM =
'ed024a78d9327f8669b3b117d9eac9e3c9460e9b'
On 2014/03/28 21:17:03, stip wrote:
> instead of removing, shouldn't we just switch it to the modified sha?

In theory - yes.
But I'm not sure why we should even bother checking if the CA cert is correct.
From a security standpoint, anyone who has access to the cert file can also
change this sha1 sum, so we don't really gain anything.

[ghost stip (do not use), 2014-03-28 21:34:09]

fair enough

[pgervais, 2014-03-28 22:10:18]

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/boto/...
File third_party/boto/README.chromium (right):

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/boto/...
third_party/boto/README.chromium:39: * Replaced boto/cacerts/cacerts.txt by file
from http://pki.google.com/roots.pem
On 2014/03/28 21:17:03, stip wrote:
> you meant https://, right?

Nope. This is the exact url I've used. I've verified that it's also available on
https, but http definitely works. Will fix it however.

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
File third_party/gsutil/oauth2_plugin/oauth2_client.py (left):

https://chromiumcodereview.appspot.com/212553007/diff/40001/third_party/gsuti...
third_party/gsutil/oauth2_plugin/oauth2_client.py:69: CACERTS_FILE_SHA1SUM =
'ed024a78d9327f8669b3b117d9eac9e3c9460e9b'
Plus replacing the certificates for developers should be as easy as possible. I
was very surprised by the very existence of this check. It sort of makes sense
for the upstream project, but not here.

[pgervais, 2014-03-28 22:12:34]

CL updated

[ghost stip (do not use), 2014-03-28 22:20:43]

lgtm

[pgervais, 2014-03-28 22:22:05]

The CQ bit was checked by pgervais@chromium.org

[commit-bot: I haz the power, 2014-03-28 22:22:09]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/pgervais@chromium.org/212553007/60001

[commit-bot: I haz the power, 2014-03-28 22:24:01]

Change committed as 260297