View source for TPE CONNECTIVITY GROUP/2015-08-25

= Weekly Status Update =
== Dimi Lee == 
* Work on Serviceworker, nothing related to NSec last week
* Will start to work on Bug 1178526 - Set appropriate origin attributes for signed packages

== Ethan Tseng ==
* Bug 1165267 - Use OriginAttributes for nsCookieService
** Upload a WIP patch to remove |appId| and |inBrowserElement| as cookie key
** The only cookie key is |baseDomain|
** Investigate internal data format of cookie (DB, hashtable and cookie list, ..., etc.)
** Make an implementation plan (thanks to Henry!) - reduce cookie DB records within the same domain while DB migration
** Paul: I assume this doesn't help?
** https://bugzilla.mozilla.org/show_bug.cgi?id=1165267#c4
* Bug 1181031 - Shared Cookie Jar

== Henry Chang == 
* Bug 1178525 - Ensure the package is verified before content is served
** f+ by Valentin
** Ideally should land after Bug 1178518 but only 2 weeks from milestone 1...
* Bug 1186290 - Notify TabParent to switch process when a signed packaged is loading from different origin.
** Works for most of the cases on both desktop browser and B2G with the following issues:
*** Need to deal with system XHR. May use "nsILoadInfo.securityFlags | SEC_SANDBOXED" to check.
*** Need to refresh the browser (like hide/show the menu bar) to get the content showed. (desktop)
*** Tab title keeps showing "Connecting"

== Jonathan Hao ==
* Bug 1178518 - Support for verifying signed packages
** Finally verifying the output of signing tool successfully (thanks to discussion with Dimi)
** Preparing to be reviewed
** Created PrivilegedPackageRoot in nsIX509CertDB
** Its private key is in my local machine, so only I can sign packages now.
* TODO: a signed package generator
* Can we reuse security/apps/marketplace-dev-public.crt?
** Marketplace did signing in https://github.com/mozilla/zamboni/

== Tim Huang ==
* Studied the WiFi stack of the firefox os.

== Winnie Sun ==
* Bug 1011358 - [wifi][wi-fi] Gecko doesn't notify Gaia when wpa_supplicant scans and finds new SSIDs/nodes
  * Under reviewing.
* Bug 1187262 - A device cannot connect B device through wifi
  * Fixed the code according to the review comment.
  * Waiting for the implementation of 'allNetworkInfo'. (Bug1197667)
* Bug 1188617 - [Aries][Utility Tray] Re-enabling wi-fi from notification tray automatically launches Settings app.
  * Under discussion about the way to improve it.
* Bug 1189143 - [Browser] Video cannot be loaded when network is connected back
  * Nothing.
* Studying about the Wifi Direct.

== Yoshi Huang ==
* Bug 1165272 -  unify Get*CodebasePrincipal with createCodebasePrincipal in nsIScriptSecurityManager. landed
* Bug 1165466 -  Fix up docshell and  loadcontext inheriting code in nsIScriptSecurityManager to use  originAttributes rather than explicitly querying appid/browser. r? sent on 8/24
* Bug 1167100 -  User nsIPrincipal.originAttribute in ContentPrincipalInfo. r?
* Bug 1196652 -  OriginSuffix is shown in about:serviceworker on b2g. ongoing

== Aaron Wu (EPM) ==
* Milestone 1 target (Sept 4, S6)
** Signing
*** Tools for developers to make and sign packages
** Verification
*** Add necko hooks for signature verification. Check package location
*** Implement signature checking (stretch goal)sd
** CSP
*** Move to milestone 2-> Apply default CSP to signed package and add tests for CSP.
** Process Isolation
*** Basic process switching (no session restore)
** Installation & Update
*** Implement cache-pinning for packages. 
*** Register permissions/ system messages on install & register web activities on pinning
** Service Workers
*** Determine implementation strategy
** Origin & Cookie Jars
*** Implement SignedPKG origin attribute. Make progress on refactoring gecko to use origin exclusively.
* Scrum Status for S5 review and S6 planning
** https://wiki.mozilla.org/FirefoxOS/New_security_model/FxOS_2.5_Scrum
** [PT ongoing]: We need the original HTTP response header for each resource for verification.(ACTION: discuss further offline)