Require HTTPS for crbug.com.

Require HTTPS for crbug.com.

BUG=373864
NOTRY=true

Committed: https://src.chromium.org/viewvc/chrome?view=rev&revision=273220

[engedy, 2014-05-19 19:19:03]

PTAL, this is adding "crbug.com" to the HSTS preload list.

@Vadim, @Mike: Would there be any implications on the server-side we have to be
aware of?

[agl, 2014-05-19 19:23:09]

Please move the addition to the bottom of the "// Force HTTPS for sites that
have requested it." section in the JSON file. Since it doesn't have Google pins,
it's a little too surprising to include in its current place.

[ghost stip (do not use), 2014-05-19 19:23:23]

This can work as long as the cert isn't pinned. When
https://code.google.com/p/chromium/issues/detail?id=162555 is fixed, we'll have
a GIAG2 cert and then we can pin it.

[engedy, 2014-05-19 23:37:35]

@Mike: Great, glad to hear that!

@Adam: Done, I have changed the ordering.

[agl, 2014-05-19 23:38:53]

lgtm

[engedy, 2014-05-20 00:00:47]

@Chris, may I proceed with landing this?

[palmer, 2014-05-27 17:30:43]

LGTM, thanks!

[engedy, 2014-05-27 18:17:03]

The CQ bit was checked by engedy@chromium.org

[commit-bot: I haz the power, 2014-05-27 18:18:46]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/engedy@chromium.org/294733002/40001

[commit-bot: I haz the power, 2014-05-27 18:50:23]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  android_aosp on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_aosp/builds/7...)
  android_chromium_gn_compile_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_chromium_gn_c...)
  android_clang_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_clang_dbg/bui...)
  android_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_dbg/builds/18...)
  chromium_presubmit on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/chromium_presubmit/bu...)
  ios_dbg_simulator on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/ios_dbg_simulator/bui...)
  ios_rel_device on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/ios_rel_device/builds...)
  ios_rel_device_ninja on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/ios_rel_device_ninja/...)
  linux_chromium_chromeos_clang_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/linux_chromium_chrome...)
  linux_chromium_chromeos_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/linux_chromium_chrome...)
  linux_chromium_clang_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/linux_chromium_clang_...)
  linux_chromium_gn_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/linux_chromium_gn_rel...)
  linux_chromium_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/linux_chromium_rel/bu...)
  mac_chromium_compile_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/mac_chromium_compile_...)
  mac_chromium_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/mac_chromium_rel/buil...)
  win_chromium_compile_dbg on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/win_chromium_compile_...)
  win_chromium_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/win_chromium_rel/buil...)
  win_chromium_x64_rel on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/win_chromium_x64_rel/...)
  linux_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/linux_gpu/builds/...)
  mac_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/mac_gpu/builds/9506)
  win_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/win_gpu/builds/12600)

[commit-bot: I haz the power, 2014-05-27 18:57:29]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-05-27 18:57:31]

Try jobs failed on following builders:
  mac_gpu on tryserver.chromium.gpu
(http://build.chromium.org/p/tryserver.chromium.gpu/builders/mac_gpu/builds/9527)

[engedy, 2014-05-28 09:05:29]

The CQ bit was checked by engedy@chromium.org

[commit-bot: I haz the power, 2014-05-28 09:05:41]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/engedy@chromium.org/294733002/60001

[commit-bot: I haz the power, 2014-05-28 10:55:28]

FYI, CQ is re-trying this CL (attempt #1).
The failing builders are:
  android_dbg_triggered_tests on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_dbg_triggered...)

[commit-bot: I haz the power, 2014-05-28 11:54:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-05-28 11:54:18]

Try jobs failed on following builders:
  android_dbg_triggered_tests on tryserver.chromium
(http://build.chromium.org/p/tryserver.chromium/builders/android_dbg_triggered...)

[engedy, 2014-05-28 11:55:32]

The CQ bit was checked by engedy@chromium.org

[commit-bot: I haz the power, 2014-05-28 11:55:49]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/engedy@chromium.org/294733002/60001

[commit-bot: I haz the power, 2014-05-28 14:28:36]

Change committed as 273220

[Peter Kasting, 2014-05-28 18:57:23]

https://codereview.chromium.org/294733002/diff/60001/net/http/transport_secur...
File net/http/transport_security_state_static.json (right):

https://codereview.chromium.org/294733002/diff/60001/net/http/transport_secur...
net/http/transport_security_state_static.json:778: { "name": "crbug.com",
"include_subdomains": true, "mode": "force-https" },
Shouldn't this go in the "Other Google-related domains that must use HTTPS"
section like codereview.chromium.org does?

Also, is there any chance we can alphabetize the entries in these lists, or
something?  The current ordering (or lack thereof) seems like a problem.

[engedy, 2014-05-28 20:57:57]

https://codereview.chromium.org/294733002/diff/60001/net/http/transport_secur...
File net/http/transport_security_state_static.json (right):

https://codereview.chromium.org/294733002/diff/60001/net/http/transport_secur...
net/http/transport_security_state_static.json:778: { "name": "crbug.com",
"include_subdomains": true, "mode": "force-https" },
The domains in the two Google-related groups all have pinned certs, this one
cannot, therefore Adam preferred to have this down here.

I agree that we should alphabetize this.
 
On 2014/05/28 18:57:23, Peter Kasting wrote:
> Shouldn't this go in the "Other Google-related domains that must use HTTPS"
> section like http://codereview.chromium.org does?
> 
> Also, is there any chance we can alphabetize the entries in these lists, or
> something?  The current ordering (or lack thereof) seems like a problem.