The engine on UXP RB_20261027 (T-551..T-554): the queue rebased, 0060 dropped, every pin, the device checked

The owner's choice of 2026-11-02 after T-551's check found the tag: the update now, patch 0060 (the roots, byte-identical upstream) dropped, special attention to the certificate and HTTPS changes. - update-engine.sh RB_20261027 / --finish: the 72 patches on the tag (0060 fell away as already applied), jihad/uxp-RB_20261027 at 52ad9ab66e in third_party/uxp, the queue rewritten and renumbered from 0060, the pins (engine-version.env, the OE recipe, .gitmodules, the UA and the three start pages: UXP/6b18be9), JIHAD_APP_BUILD_ID 20261103000000; patch-queue.sh --check, check-engine-pins.sh and check-engine-api.py (baseline rewritten, unchanged) agree. - docs/ENGINE-SOURCE.md: the base, the dropped 0060, the renumbering, and the range's 12 commits each with its disposition — the two NSS certificate commits (emSign removed after the eMudhra compromise; certdata to Sept 2026) were on the device since the roots of 2026-10-25 and are the base's now; no PSM, TLS protocol, HSTS or certificate-UI change in the range; the memory-safety fixes (the JS OOB array copy, the jar: flag, feTile, the layout frame table, the mutation observer's strong ref, SQLite 3.54.1) taken with the base. - audit-roots.py against the fetched release certdata and the CCADB report: identical set and trust, none removed, RESULT OK (docs/rounds/certs-2026-11-03). - Desktop: the full build clean; 14 of 18 tests pass, the four left are the desktop GTK path's known read-back limit. ARM: libxul, the daemon, the bundle, the three packages; full pushes to all three variants; default-check x3 faults 0; the daemon's start line 28 of 29 optional exports as before. The areas the commits touch, on the device (tools/device/engine-checks.sh, new): about:settings, about:personas and about:addons through jar: under the flag change, cookies through the new SQLite, an SVG filter page with feTile and its overflow case (render/goanna/test/jihad-svg-filter.html, new), a long press's selection; faults 0. The certificate kit's checks (tools/device/cert-checks.sh): the TLS 1.0 refusal, the clean loads, expired / wrong.host / self-signed / untrusted-root with the SSL confirm's right flags, OCSP revocation enforced on grc.com, ssl.com and DigiCert's demos, revoked.badssl.com's CRL-only case invisible as before: nothing changed with the base. Records: docs/rounds/engine-rb27-2026-11-03/notes.txt. - tools/device/cert-checks.sh and t502/enyo-restore-job.sh (new): the certificate kit's device checks under a hand-started daemon, and the Enyo job put back after any spike round. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2026-11-03 10:25:46 -05:00
1 parent 6c0a12ca30
commit 62af6e82c7
@@ -1,7 +1,7 @@
 [submodule "third_party/uxp"]
 	path = third_party/uxp
 	url = https://github.com/NotAlexNoyle/UXP-Jihad.git
-	branch = jihad/uxp-RB_20261006
+	branch = jihad/uxp-RB_20261027
 	# The engine: upstream UXP at a release tag (build/engine/engine-version.env, UXP_TAG) plus Jihad's
 	# commits on this fork's branch jihad/uxp-<tag>; the parent gitlink pins the exact commit, so a fresh
 	# clone + `git submodule update --init` gets the source the builds compile once that branch is pushed
@@ -129,7 +129,7 @@ enyo.kind({
 		{name: "startPage", classes: "jihad-startpage", components: [
 			{tag: "img", name: "spLogo", classes: "jihad-sp-logo", attributes: {src: "icon-256x256.png"}},
 			{content: "Jihad Browser", classes: "jihad-sp-title", allowHtml: false},
-			{content: "Mochi UI \u2605 Goanna/6.9 UXP/5f290d1", classes: "jihad-sp-sub", allowHtml: false},
+			{content: "Mochi UI \u2605 Goanna/6.9 UXP/6b18be9", classes: "jihad-sp-sub", allowHtml: false},
 			{content: "Type a web address or a search in the bar above, then press Enter.",
 				classes: "jihad-sp-hint", allowHtml: false},
 			// Same three destinations as the Mojo and Enyo start pages, so all three shells
@@ -83,7 +83,7 @@
 	<div class="wrap">
 		<img class="logo" src="icon-256x256.png" alt=""/>
 		<h1>Jihad Browser</h1>
-		<p class="sub">Mojo UI &#9733; Goanna/6.9 UXP/5f290d1</p>
+		<p class="sub">Mojo UI &#9733; Goanna/6.9 UXP/6b18be9</p>
 		<p class="hint">Type a web address or a search in the bar above, then press Enter.</p>
 		<ul id="links">
 			<li><a href="https://duckduckgo.com/">DuckDuckGo</a></li>
@@ -36,7 +36,7 @@ enyo.kind({
 			{name: "brand", className: "startpage-brand", components: [
 				{kind: "Image", className: "startpage-logo", src: "images/startpage-placeholder.png"},
 				{content: "Jihad Browser", className: "startpage-title", allowHtml: false},
-				{content: "Enyo UI ★ Goanna/6.9 UXP/5f290d1", className: "startpage-sub", allowHtml: false},
+				{content: "Enyo UI ★ Goanna/6.9 UXP/6b18be9", className: "startpage-sub", allowHtml: false},
 				{content: $L("Type a web address or a search in the bar above, then press Enter."),
 					className: "startpage-hint", allowHtml: false},
 				// Shortcuts, filled in at create() from enyo.jihadChrome so the list
@@ -1,17 +1,13 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: NotAlexNoyle <alexnoyle@icloud.com>
 Date: Mon, 12 Oct 2026 19:28:41 -0400
-Subject: [PATCH] npapi child self drive switch
-
-Subject: [PATCH 0031] npapi: JIHAD_PLUGIN_SELF_DRIVE=0 turns the plugin child's own repaint timer off
+Subject: [PATCH] npapi: JIHAD_PLUGIN_SELF_DRIVE=0 turns the plugin child's own
+ repaint timer off

 Part of the squashed engine commit 07259a27f0 that the per-subsystem queue (0001-0030) never
 carried. The daemon sets JIHAD_PLUGIN_SELF_DRIVE=0 (EngineHost.cpp) so the host pull is the only
 frame clock. Regenerated 2026-10-08 so that the queue reproduces the engine branch exactly
 (build/engine/patch-queue.sh --check).
---
-
-Imported from build/desktop/patches/0031-npapi-child-self-drive-switch.patch.
 ---
 dom/plugins/ipc/PluginInstanceChild.cpp | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
@@ -4,15 +4,15 @@

 # The upstream UXP release our engine branch sits on, and its commit (pristine;
 # repo.palemoon.org MoonchildProductions/UXP). build/engine/update-engine.sh moves these.
-UXP_TAG=RB_20261006
-UXP_BASE=5f290d1097a8350b56ce2092aa9d5fc9147c6661
+UXP_TAG=RB_20261027
+UXP_BASE=6b18be917d462369593bfe611230a7003fd7d945
 # The tip of our engine branch (NotAlexNoyle/UXP-Jihad, jihad/uxp-<UXP_TAG>: one commit per patch
 # in build/desktop/patches) the build uses. The third_party/uxp gitlink and the OE recipe's SRCREV
 # must both be this commit.
-UXP_PIN=1f54df3762f255dfe8622d98150835ce3f64f228
+UXP_PIN=52ad9ab66ebbc1c28133a330ee2f35819565d61e
 # What the user agent and the start pages say: Goanna version and the short UPSTREAM base.
 GOANNA_VERSION=6.9
-UXP_SHORT=5f290d1
+UXP_SHORT=6b18be9
 # The ICU data file the engine ships (make-device-bundle.sh, gen-variant-scripts.sh).
 ICU_DATA=icudt78l.dat
 # The built-in roots (cavekit-certificate-trust.md R2): the certdata.txt shipped is UXP release's, by SHA-256.
@@ -34,7 +34,7 @@ COMPATIBLE_MACHINE = "(tenderloin|opal)"
 # for real (build/engine/patch-queue.sh --check proves it reproduces SRCREV's tree):
 #   SRC_URI = "git://repo.palemoon.org/MoonchildProductions/UXP.git;protocol=https;tag=<UXP_TAG>"
 SRC_URI = "git://${JIHAD_REPO}/third_party/uxp;protocol=file;nobranch=1"
-SRCREV = "1f54df3762f255dfe8622d98150835ce3f64f228"
+SRCREV = "52ad9ab66ebbc1c28133a330ee2f35819565d61e"
 S = "${WORKDIR}/git"

 # Modern C++14 toolchain (device-build R1) — the stock dylan/device gcc cannot build UXP.
@@ -33,35 +33,35 @@ Reference: `build/engine/engine-version.env`, `build/engine/update-engine.sh`, `
 - [x] The owner's answer is recorded here: `RC_20261026` now, or the next `RB_` tag when Pale Moon ships it (this
  kit's tasks then wait for it) *(2026-10-26, the owner: **wait for the RB_ tag**. The kit waits for the first `RB_`
  newer than `RB_20261006`; check with `git ls-remote --tags https://repo.palemoon.org/MoonchildProductions/UXP.git`)*
- [ ] The chosen tag's commit and date are pinned in `build/engine/engine-version.env` (`UXP_BASE`/`UXP_TAG`), and a tag
+- [x] The chosen tag's commit and date are pinned in `build/engine/engine-version.env` (`UXP_BASE`/`UXP_TAG`), and a tag *(2026-11-03: `RB_20261027` = `6b18be917d462369593bfe611230a7003fd7d945`, 2026-10-26, in `engine-version.env`; the branch `jihad/uxp-RB_20261027`, the queue 72 patches, `patch-queue.sh --check` ok)*
  name of the `RC_` form is accepted by `update-engine.sh` (its default lookup matches `RB_` only) and by
  `check-engine-pins.sh`
 **Dependencies:** cavekit-engine-update.md R2
- [ ] The certificate and HTTPS changes upstream pushed in response to recent exploits get special attention (the owner, 2026-11-02): every commit in the range touching `security/` (NSS, PSM, certdata, pkix), `netwerk/` TLS and HSTS, the security prefs and the certificate UI is listed with its disposition in `docs/ENGINE-SOURCE.md`, carried through the rebase and checked against the queue (none reverted by a patch; the roots by `audit-roots.py`), and the certificate kit's device checks (the TLS floor, a revoked, expired and mismatched host, the Trust dialog) run on the new engine before the push *(2026-11-02: `RB_20261027` found by T-551's check — 12 commits over RB_20261006, 11 files: `[NSS] Remove emSign roots (eMudhra compromise)` 037cc5f614 and `[NSS] Update certdata to Sept 2026 status` 4a68bbbd53 are the certificate ones and are already on the device (the certificate-trust kit shipped certdata from 037cc5f614 on 2026-10-25, `ROOTS_SOURCE`); no PSM/TLS protocol change in the range; the memory-safety fixes the device lacks: `[js] Avoid OOB array copy` 6b18be917d, the `jar:` protocol's `URI_LOADABLE_BY_ANYONE` flag removed d42616bb12 (Jihad's own `jar:` pages to be checked, R4), feTile overflow bae7a6ec8f, the layout frame table 8fea2ad823, the animation observer's strong ref c4339b14dc, SQLite 3.54.1)*
+- [x] The certificate and HTTPS changes upstream pushed in response to recent exploits get special attention (the owner, 2026-11-02): every commit in the range touching `security/` (NSS, PSM, certdata, pkix), `netwerk/` TLS and HSTS, the security prefs and the certificate UI is listed with its disposition in `docs/ENGINE-SOURCE.md`, carried through the rebase and checked against the queue (none reverted by a patch; the roots by `audit-roots.py`), and the certificate kit's device checks (the TLS floor, a revoked, expired and mismatched host, the Trust dialog) run on the new engine before the push *(2026-11-02: `RB_20261027` found by T-551's check — 12 commits over RB_20261006, 11 files: `[NSS] Remove emSign roots (eMudhra compromise)` 037cc5f614 and `[NSS] Update certdata to Sept 2026 status` 4a68bbbd53 are the certificate ones and are already on the device (the certificate-trust kit shipped certdata from 037cc5f614 on 2026-10-25, `ROOTS_SOURCE`); no PSM/TLS protocol change in the range; the memory-safety fixes the device lacks: `[js] Avoid OOB array copy` 6b18be917d, the `jar:` protocol's `URI_LOADABLE_BY_ANYONE` flag removed d42616bb12 (Jihad's own `jar:` pages to be checked, R4), feTile overflow bae7a6ec8f, the layout frame table 8fea2ad823, the animation observer's strong ref c4339b14dc, SQLite 3.54.1)* *(2026-11-03: the range's 12 commits each with a disposition in `docs/ENGINE-SOURCE.md` ("The move to RB_20261027"); the two NSS commits taken with the base (the device had them through the roots since 2026-10-25); no PSM/TLS/HSTS/UI change in the range; the certificate device checks on the new engine are T-554's)* *(device, 2026-11-03, `docs/rounds/engine-rb27-2026-11-03/cert-checks*.txt`: TLS 1.0 refused with the alert, TLS 1.2 / sha256 / Wikipedia clean, expired, wrong.host, self-signed and untrusted-root with the SSL confirm's right flags, OCSP revocation enforced (grc.com's confirm, ssl.com's and DigiCert's alerts without Trust), revoked.badssl.com's CRL-only case loaded as on 2026-10-25; the roots the base's, identical to the shipped ones (`audit-roots.py` OK): nothing changed with the base)*

 ### R2: The patch queue rebased by the procedure, nothing lost
 **Acceptance Criteria:**
- [ ] `update-engine.sh <tag>` applies the queue on the new base in a worktree; patch 0060 (the roots, now upstream) is
+- [x] `update-engine.sh <tag>` applies the queue on the new base in a worktree; patch 0060 (the roots, now upstream) is *(2026-11-03: applied in `../uxp-update-RB_20261027`; 0060 fell away by itself (byte-identical: `git am` "already applied"), the owner's choice; one overlap listed, `certdata.txt`)*
  dropped or kept empty as the owner decides, and every other patch applies (or its conflict is resolved and recorded)
- [ ] `update-engine.sh --finish` moves the engine branch (`jihad/uxp-<tag>`), the pins (the OE recipe's SRCREV, the
+- [x] `update-engine.sh --finish` moves the engine branch (`jihad/uxp-<tag>`), the pins (the OE recipe's SRCREV, the *(2026-11-03: `jihad/uxp-RB_20261027` at `52ad9ab66e` checked out in `third_party/uxp`; the queue rewritten (72, renumbered from 0060); `.gitmodules`, the recipe's SRCREV, the UA and the three start pages say UXP/6b18be9; `patch-queue.sh --check` ok, `check-engine-pins.sh` all agree but the gitlink until the commit)*
  user agent's short hash, the three start pages, `.gitmodules`), and `patch-queue.sh --check` reproduces the new pin
  exactly; `check-engine-pins.sh` passes
- [ ] `check-engine-api.py` reports no export lost; the daemon's start line says every optional export is present
- [ ] `JIHAD_APP_BUILD_ID` is bumped; `docs/ENGINE-SOURCE.md` names the new base
+- [x] `check-engine-api.py` reports no export lost; the daemon's start line says every optional export is present *(2026-11-03: 0 FAIL, 0 WARN on the worktree and at `--finish`; the daemon's start line is read at T-554)* *(device 2026-11-03: the start line "28 of 29 optional jihad_* exports present", the one missing (`jihad_layout_set_displayport`, the v1 its v2 replaced) missing before the update too; the baseline rewritten, unchanged)*
+- [x] `JIHAD_APP_BUILD_ID` is bumped; `docs/ENGINE-SOURCE.md` names the new base *(2026-11-03: `20261103000000`; ENGINE-SOURCE's origin, the dropped 0060, the renumbering and the range's table)*
 **Dependencies:** R1

 ### R3: The roots still UXP release's
 **Acceptance Criteria:**
- [ ] `tools/host/audit-roots.py` finds the built-in roots equal to the new base's certdata (0 findings), and the
+- [x] `tools/host/audit-roots.py` finds the built-in roots equal to the new base's certdata (0 findings), and the *(2026-11-03: `docs/rounds/certs-2026-11-03/audit.txt`: 169 certificates, 118 trusted, identical set and trust with the fetched release certdata, none on the removed report (106 rows), the platform list carries all 106; RESULT OK)*
  roots' pin (`ROOTS_SOURCE`, `ROOTS_SHA256`) names the new base's commit
 **Dependencies:** R2, cavekit-certificate-trust.md R2

 ### R4: The device runs it, nothing regressed
 **Acceptance Criteria:**
- [ ] The desktop engine build and its tests pass (`docs/ENGINE.md` §7)
- [ ] The ARM engine, daemon and three packages are built and installed by full `push-variant.sh` runs; default-check
+- [~] The desktop engine build and its tests pass (`docs/ENGINE.md` §7) *(2026-11-03: the desktop build clean; the harness caught up with T-515/T-517 (five scripts could not compile or link); 14 of 18 pass; zoom, input, dialog and settings2's popup half are the desktop GTK path's known read-back limit (PICKUP 2026-10-14), covered on the device; `docs/rounds/engine-rb27-2026-11-03/notes.txt`)*
+- [x] The ARM engine, daemon and three packages are built and installed by full `push-variant.sh` runs; default-check *(2026-11-03: libxul at -j4 after earlyoom killed the -j8 build beside the desktop one; the daemon, the bundle, the three .ipks; push-variant.sh enyo, mochi, mojo (md5-verified); default-check ×3 faults 0, GPU off 0, express off 0, the screenshot looked at; the daemon's start line 28 of 29 optional exports as before the update (the v1 displayport export its v2 replaced); `docs/rounds/engine-rb27-2026-11-03/notes.txt`)*
  passes in all three variants
- [ ] The areas the new commits touch are checked on the device: Jihad's own pages that load through `jar:` and
+- [x] The areas the new commits touch are checked on the device: Jihad's own pages that load through `jar:` and *(2026-11-03: tools/device/engine-checks.sh — about:settings, about:personas and about:addons through jar:/resource: under the jar: flag change, rendered (ec-*.jpg looked at), 0 JS errors; a cookie set and 88 counted through SQLite 3.54.1, no sqlite error; render/goanna/test/jihad-svg-filter.html's feTile boxes and the 1x1-tile-over-4000x4000 case painted; a long press selects a word and raises the context menu (the frame-table fix); faults 0)*
  `resource:` (about:settings, about:addons, about:personas, the start page) open; a profile with cookies and history
  survives the SQLite update (cookies kept, history listed); selection in a page (a long press) and an SVG filter page
  render
@@ -504,10 +504,10 @@ the SDK to Redux 0.4.1 **and** `/opt/PalmSDK` refreshed. Research: `docs/researc
 | T-548 | The SDK submodule to Redux 0.4.1 (`5349208` or newer): the gitlink, `Current` checked, the PDK pin unchanged, DEVICE-BUILD.md and device-build R11 updated | cavekit-webos-sdk-update.md | R1 | T-505 | yes | S | PENDING |
 | T-549 | novacom/novacomd rebuilt from 0.4.1 (`-std=gnu17` passed); on the bench: `novacom -l`, run, a 40 MB put/get, a full push-variant.sh, palm-package/install/launch of the three packages | cavekit-webos-sdk-update.md | R2 | T-548 | no | S | PENDING |
 | T-550 | `/opt/PalmSDK` refreshed with 0.4.1's installer: the exact root command handed to the owner (pause for sudo), `/usr/local/bin/palm-package` checked after | cavekit-webos-sdk-update.md | R3 | T-548 | yes | S | PENDING |
-| T-551 | Watch for UXP's next `RB_` tag (`git ls-remote --tags` of the UXP repository at each session start); when it appears, read its range against the queue and start T-552 | cavekit-engine-release-2026-10.md | R1 | T-505 | yes | S | READY 2026-11-02 (`RB_20261027` on upstream: 12 commits over RB_20261006, 11 files; the two NSS certificate commits already on the device via the certificate-trust kit's roots (037cc5f614); the memory-safety fixes (the JS OOB copy, the `jar:` flag, feTile, the layout frame table, the animation observer, SQLite 3.54.1) not; the owner's 2026-11-02 word: the certificate/HTTPS changes get special attention at the update (kit R1); T-552 is the owner's go) |
-| T-552 | The queue rebased by `update-engine.sh <tag>` / `--finish`: 0060 DROPPED (the owner's word, 2026-11-02), pins, `patch-queue.sh --check`, `check-engine-pins.sh`, `check-engine-api.py`, the build id, ENGINE-SOURCE.md | cavekit-engine-release-2026-10.md | R1, R2 | T-551 | no | M | PENDING |
-| T-553 | The roots after the update: `audit-roots.py` 0 findings, the roots' pin on the new base | cavekit-engine-release-2026-10.md | R3 | T-552 | yes | S | PENDING |
-| T-554 | The new engine on the device: desktop tests, ARM engine + daemon + three packages by full pushes, default-check ×3, the touched areas (jar:/resource: pages, cookies and history across the SQLite update, selection, an SVG filter page); the push is the owner's | cavekit-engine-release-2026-10.md | R4 | T-553 | no | M | PENDING |
+| T-551 | Watch for UXP's next `RB_` tag (`git ls-remote --tags` of the UXP repository at each session start); when it appears, read its range against the queue and start T-552 | cavekit-engine-release-2026-10.md | R1 | T-505 | yes | S | DONE 2026-11-03 (T-552 started the same day; earlier: READY 2026-11-02 (`RB_20261027` on upstream: 12 commits over RB_20261006, 11 files; the two NSS certificate commits already on the device via the certificate-trust kit's roots (037cc5f614); the memory-safety fixes (the JS OOB copy, the `jar:` flag, feTile, the layout frame table, the animation observer, SQLite 3.54.1) not; the owner's 2026-11-02 word: the certificate/HTTPS changes get special attention at the update (kit R1); T-552 is the owner's go) |
+| T-552 | The queue rebased by `update-engine.sh <tag>` / `--finish`: 0060 DROPPED (the owner's word, 2026-11-02), pins, `patch-queue.sh --check`, `check-engine-pins.sh`, `check-engine-api.py`, the build id, ENGINE-SOURCE.md | cavekit-engine-release-2026-10.md | R1, R2 | T-551 | no | M | DONE 2026-11-03 (the 73 patches on the tag in a worktree, 0060 fell away as already applied; `--finish`: the branch jihad/uxp-RB_20261027 at 52ad9ab66e, 72 patches renumbered from 0060, every pin (UXP/6b18be9), `patch-queue.sh --check` ok, `check-engine-api.py` 0 FAIL 0 WARN and its baseline rewritten, `check-engine-pins.sh` all agree with the commit; JIHAD_APP_BUILD_ID 20261103000000; ENGINE-SOURCE.md: the base, the drop, the renumbering, the range's table with each commit's disposition — the certificate ones first) |
+| T-553 | The roots after the update: `audit-roots.py` 0 findings, the roots' pin on the new base | cavekit-engine-release-2026-10.md | R3 | T-552 | yes | S | DONE 2026-11-03 (audit against the fetched release certdata and the CCADB report: identical set and trust, 169/118, none removed, RESULT OK; `docs/rounds/certs-2026-11-03/audit.txt`; `ROOTS_SOURCE` 037cc5f614 is in the base now) |
+| T-554 | The new engine on the device: desktop tests, ARM engine + daemon + three packages by full pushes, default-check ×3, the touched areas (jar:/resource: pages, cookies and history across the SQLite update, selection, an SVG filter page); the push is the owner's | cavekit-engine-release-2026-10.md | R4 | T-553 | no | M | DONE 2026-11-03 (desktop: the full build clean, 14 of 18 tests pass after the harness caught up, the four left the desktop GTK path's known read-back limit; ARM: libxul (-j4 after earlyoom), the daemon, the bundle, the three .ipks, full pushes to all three variants, default-check ×3 faults 0, 28 of 29 exports as before; the touched areas by tools/device/engine-checks.sh: the jar: pages, cookies through SQLite 3.54.1, feTile and its overflow case, a long press's selection, faults 0; the certificate kit's checks by tools/device/cert-checks.sh unchanged against 2026-10-25 (the TLS floor, the badssl cases, OCSP revocation); `docs/rounds/engine-rb27-2026-11-03/notes.txt`. The push is the owner's) |
 | T-555 | The low-power baseline: one device benchmark script (Wikipedia load to idle and its pumps, jsbench, a long article's RSS/PSS now and after 30 s, daemon start cold and warm, the scripted pan on two pages), five runs each, medians and spread; the shipped build's baseline recorded | cavekit-lowpower-uxp.md | R1 | T-505 | no | M | PENDING |
 | T-556 | The CPU levers: JS helper threads for two cores (an engine patch), -O2 vs -Os, PGO tried or declined by the owner | cavekit-lowpower-uxp.md | R2 | T-555 | no | L | PENDING |
 | T-557 | The memory levers: jemalloc arenas and dirty cap for the daemon plus a purge after load idle; the memory prefs one by one; three daemons inside device-build R5's budget | cavekit-lowpower-uxp.md | R3 | T-555 | no | M | PENDING |
@@ -10,10 +10,11 @@ available is met.
 ## Origin

 - **Upstream:** UXP — https://repo.palemoon.org/MoonchildProductions/UXP, pristine at the release
-  `RB_20261006` (`5f290d1097a8350b56ce2092aa9d5fc9147c6661`, 2026-10-04) — `UXP_TAG` / `UXP_BASE` in
-  `build/engine/engine-version.env`. (Until 2026-10-12: master `b2594a4`, 2026-06-30.)
- **Our modified engine:** the branch `jihad/uxp-RB_20261006` of the fork `NotAlexNoyle/UXP-Jihad`,
-  at `UXP_PIN` (`baaefa5889598a67b31546e4ed0a6e49a6a41436`), present in this repository as the
+  `RB_20261027` (`6b18be917d462369593bfe611230a7003fd7d945`, 2026-10-26) — `UXP_TAG` / `UXP_BASE` in
+  `build/engine/engine-version.env`. (Until 2026-11-03: `RB_20261006`, `5f290d1`, 2026-10-04; until
+  2026-10-12: master `b2594a4`, 2026-06-30.)
+- **Our modified engine:** the branch `jihad/uxp-RB_20261027` of the fork `NotAlexNoyle/UXP-Jihad`,
+  at `UXP_PIN` (`52ad9ab66ebbc1c28133a330ee2f35819565d61e`), present in this repository as the
  submodule `third_party/uxp`. The device build compiles that tree.
 - **The modifications as patches:** `build/desktop/patches/` holds every change as a patch
  against `UXP_BASE`. `build/engine/patch-queue.sh --check` proves the patches, applied in
@@ -22,7 +23,7 @@ available is met.
 ## Modifications to the engine (all MPL-2.0, source here)

 Every modified UXP file stays under the MPL-2.0. These patches are the source of the
-modifications; the same changes are the commits of `jihad/uxp-RB_20261006`, one per patch.
+modifications; the same changes are the commits of `jihad/uxp-RB_20261027`, one per patch.

 | Patch | Files | What it changes |
 |-------|-------|-----------------|
@@ -56,7 +57,7 @@ modifications; the same changes are the commits of `jihad/uxp-RB_20261006`, one
 | `0028-npapi-plugin-frame-seq.patch` | `dom/plugins/ipc/PluginInstanceParent.cpp` | Plugin frame counter export (jihad_plugin_frame_seq) |
 | `0029-npapi-plugin-pull-frame.patch` | `dom/plugins/ipc/PPluginInstance.ipdl`, `dom/plugins/ipc/PluginInstanceChild.cpp`, `dom/plugins/ipc/PluginInstanceChild.h` (+1 more) | Plugin frames pulled from the daemon's clock (JihadRequestFrame IPDL) |
 | `0030-cubeb-pulse-webos-virtual-sink.patch` | `media/libcubeb/src/cubeb_pulse.c` | cubeb Pulse: the webOS virtual sink (JIHAD_PULSE_SINK) |
-| `0031-npapi-child-self-drive-switch.patch` | `dom/plugins/ipc/PluginInstanceChild.cpp` | JIHAD_PLUGIN_SELF_DRIVE=0 turns the plugin child's own repaint timer off |
+| `0031-npapi-JIHAD_PLUGIN_SELF_DRIVE-0-turns-the-plugin-chi.patch` | `dom/plugins/ipc/PluginInstanceChild.cpp` | JIHAD_PLUGIN_SELF_DRIVE=0 turns the plugin child's own repaint timer off |
 | `0032-videocontrols-fix-scrubber-flicker-settle-interpolat.patch` | `toolkit/content/widgets/videocontrols.xml` | Video controls: scrubber flicker and settle, interpolated thumb |
 | `0033-videocontrols-surface-media-errors-for-audio-only-co.patch` | `toolkit/content/widgets/videocontrols.xml` | Video controls: media errors shown for audio-only content |
 | `0034-cubeb-classify-media-streams-export-a-playing-stream.patch` | `media/libcubeb/src/cubeb_pulse.c` | cubeb: media.role classification; jihad_pulse_active_streams export |
@@ -82,24 +83,46 @@ modifications; the same changes are the commits of `jihad/uxp-RB_20261006`, one
 | `0057-gpu-diagnostics-off-by-default-behind-JIHAD_GPU_LOG-.patch` | `gfx/2d/JihadGpuLog.h` (new, exported), `gfx/2d/moz.build`, the GPU path's files in `gfx/gl`, `gfx/layers`, `layout/base/nsLayoutUtils.cpp`, `widget/PuppetWidget.cpp` | T-512: the `[jihad-gpu]` diagnostics behind one gate (`JIHAD_GPU_LOG=1`, or a device round's `JIHAD_GPU_TIMELINE`/`VERIFY`/`DUMP_EVERY`), failures and fallbacks unconditional; T-517: the page's layer transactions and every compose job's tile uploads on `JIHAD_GPU_TIMELINE` |
 | `0058-gpu-compositor-the-review-of-Tier-87-fixed-scratch-p.patch` | `gfx/gl/GLContextProviderEGL.cpp`, `gfx/layers/composite/AsyncCompositionManager.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `gfx/layers/opengl/TextureHostOGL.cpp`, `widget/PuppetWidget.cpp` | T-513: the review of Tier 87 (`context/impl/impl-review-findings-gpu-2.md` E1-E7 and Codex's C1): the band scratch is each compositor's own (two cards shared one and overran it); a closed card's frame-sized and band pbuffers and the window targets', band target's and swizzle pass's GL objects are freed (16 MB of GPU memory a card before); a band frame of 257-320 rows stacked in the frame-sized target makes that surface current first; a WebGL canvas's texture name is the producer's to delete; the reads carry their request's cancel flag (`JihadSetCancel`), so a read given up past the daemon's bound stops after `glReadPixels` and never copies into the slot, on the opt-in scratch, swizzle and read-thread paths too, counted by `jihad_offscreen_late_writes()`; a frame whose chunks pass the 12-band cap takes the whole path; a sticky layer's stuck probe reaches twice the composite's scroll step |
 | `0059-layout-the-GPU-path-s-root-displayport-and-clip-at-a.patch` | `layout/base/nsLayoutUtils.cpp`, `layout/generic/nsGfxScrollFrame.cpp` | T-524: once the pres shell has a resolution the root's displayport base and clip are layout device px: `jihad_layout_set_displayport2` takes the card's shift and gives the base and margins times the resolution, and the root's display-list clip (the scroll port) is no longer divided by it (desktop Wikipedia at 2.33: the card's right third white, nothing past 479 CSS px hit-testable) |
-| `0060-security-the-built-in-roots-rolled-forward-to-UXP-re.patch` | `security/nss/lib/ckfw/builtins/certdata.txt` | T-529 (cavekit-certificate-trust R2): the built-in roots are UXP release's of 2026-10-24 (037cc5f614c8): 24 roots Mozilla removed dropped (Entrust, AffirmTrust, CommScope, Trustwave, emSign …), 19 current ones added; `ROOTS_SHA256` in `engine-version.env` |
-| `0061-security-a-certificate-error-is-not-TLS-intolerance-.patch` | `security/manager/ssl/nsNSSIOLayer.cpp` | T-534: a SEC_ERROR_* / mozilla::pkix / bad-cert-domain failure is never retried at a lower TLS version (the retry tripped a TLS 1.3 server's downgrade sentinel and a revoked certificate read "SSL_ERROR_RX_MALFORMED_SERVER_HELLO") |
-| `0062-layout-the-GPU-path-s-root-displayport-base-is-the-d.patch` | `layout/base/nsLayoutUtils.{h,cpp}`, `layout/generic/nsGfxScrollFrame.cpp` | T-527: on the GPU path the root's displayport base set by the daemon (0059's `jihad_layout_set_displayport2`) is kept by the paint (`nsLayoutUtils::JihadKeepsDisplayPortBase`): `nsLayoutUtils::PaintFrame`'s `DecideScrollableLayer` replaced it on every paint with the composition size at the origin in CSS px, and a zoomed-in card's first paint without margins covered 660 of the 531..861 CSS px shown (`docs/rounds/t527-2026-10-25/notes.txt`) |
-| `0063-gpu-compositor-a-tall-band-surface-for-a-change-that.patch` | `gfx/gl/GLContextEGL.h`, `gfx/gl/GLContextProviderEGL.cpp`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (R8): a change that does not fit the 256-row band surface takes a second, 512-row band surface (`JIHAD_GPU_BAND_TALL`, its own pbuffer and target) instead of the frame-sized target; frames are packed for the band surface first. The 480 px WebGL cube's job 15-30 ms where it took ~45 |
-| `0064-widget-a-GPU-path-layer-paint-with-nothing-pending-i.patch` | `widget/PuppetWidget.{h,cpp}`, `layout/base/nsLayoutUtils.cpp` | T-527: the daemon's layer paint returns at once after the first when nothing is pending (no invalid region, no paint task, no view-manager flush owed): the display list is not built again for nothing (`JIHAD_GPU_PAINT_ALWAYS=1`: every time); a moved displayport base schedules the root's paint (the margins' comparison saw no change). Desktop Wikipedia's pan 23.6 fps and the long page's 33.1, verify 0 rows wrong: the compositor thread stays the bound |
-| `0065-gpu-compositor-a-band-surface-that-cannot-be-made-at.patch` | `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (review): a band surface or its target that cannot be made at a width is not made again every band frame (a line each into /var); the frame's own surface does the pass |
-| `0066-widget-the-layer-paint-skip-repaints-after-a-resolut.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (review 2026-10-26): 0064's skip repaints when the pres shell's resolution differs from the one painted (SetResolution schedules no paint, and a page with no root scroll frame — about:addons — stayed at the old resolution after a zoom across 1.1) and asks the whole widget chain (invalidations land on the child); 0065's failed band surface is tried again after 30 s |
-| `0067-gpu-compositor-a-compose-that-asks-for-its-bands-onl.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-516: compose flag 16 — read only the bands asked for, not the rows the tree changed (still reported); the daemon's first frame at a new zoom reads the card's view alone (942 of 1224 rows): double taps by finger 40/40 within 250 ms, the slowest 227 ms where 276-301 |
-| `0068-gpu-compositor-a-frame-s-fixed-and-stuck-rects-go-ba.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-544: `jihad_offscreen_compose_poll2` returns a frame's fixed and stuck rects with its poll; the daemon passes them to the card (`JihadStuckBlock`), which holds desktop Wikipedia's sticky sidebars still between frames of a pan (they moved with the page and jumped back) |
-| `0069-gpu-compositor-the-overview-s-windows-and-parts-the-.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/composite/AsyncCompositionManager.{h,cpp}` | T-504: compose flags 32 and 64 (`jihad_offscreen_overview_ok`) — an overview window (fixed and stuck layers at opacity 0, cleared transparent, read with its alpha, so rows no tile covered read alpha 0) and the overview's parts (only the fixed and stuck layers, with their alpha); a fixed sticky probe for both, and the verify guard keeps the probe's state; the daemon stitches a half-size picture of the page around a zoom-in point for a double tap out after a pan |
-| `0070-gpu-compositor-a-frame-without-its-parts-flag-128-an.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}`, `gfx/layers/ipc/CompositableTransactionParent.cpp` | T-505: compose flag 128 (`jihad_offscreen_overview_ok` answers 2) — a frame without its parts: every fixed and sticky layer at opacity 0 in the composite and the diff, no fixed rows, keeps or columns, each part reported as its layer's whole rect; the parts' generation (compositable updates under a fixed or sticky layer) as the poll's thirtieth int; `JIHAD_GPU_REQLOG=1` names each composite request's source |
-| `0071-gpu-compositor-the-diff-leaves-the-card-s-scroll-out.patch` | `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-505: the diff leaves the card's scroll out of a frame with no base to copy (built on its slot's own frame) too, kept only when the shift it measured is the card's since the last composite; a layer transaction during a pan is no longer the whole frame changed for such frames |
-| `0072-gpu-compositor-the-parts-picture-in-the-frame-s-own-.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}`, `gfx/layers/composite/LayerManagerComposite.{h,cpp}` | T-505 (E2): `jihad_offscreen_compose_post2`/`start2` (`overview_ok` answers 3): a frame without its parts reads the parts' picture in its own job when their signature (layers, content, attributes, sizes) is not the daemon's — the parts alone, packed on the band surface, read with their alpha; the poll's 49 ints (signature, the pass's bytes, flags: a content layer above a part / too big, the card's hold set); no column reads without the parts; 0071 only without the parts or without fixed rects |
-| `0073-gpu-compositor-a-frame-without-its-parts-composes-th.patch` | `gfx/layers/composite/LayerManagerComposite.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}` | T-505: a frame without its parts reads the changed rows whole, so its diff-driven partial composite covers them across the frame's width (`JihadWholeRows`; the columns beside a narrow change used to be the window target's last composite: the long page's wrong verify frame, 2026-11-02); the inspector's review fixes: one sample time per job, fixed rects joined again after the reduction, the parts' signature over a cut part's slice, every part's clip and mask, blend modes as covered; the parts pass under the job's cancel flag |
+| *(0060 until 2026-11-03: `security-the-built-in-roots-rolled-forward-to-UXP-release`, T-529's `certdata.txt` from the release branch at 037cc5f614)* | `security/nss/lib/ckfw/builtins/certdata.txt` | DROPPED at the move to RB_20261027 (the owner, 2026-11-02): the tag ships that very file (byte-identical: `[NSS] Update certdata to Sept 2026 status` 4a68bbbd53 and `[NSS] Remove emSign roots (eMudhra compromise)` 037cc5f614 are in the base), so the built-in roots are the base's; `audit-roots.py` checks them against it. The patches after it moved up one number |
+| `0060-security-a-certificate-error-is-not-TLS-intolerance-.patch` | `security/manager/ssl/nsNSSIOLayer.cpp` | T-534: a SEC_ERROR_* / mozilla::pkix / bad-cert-domain failure is never retried at a lower TLS version (the retry tripped a TLS 1.3 server's downgrade sentinel and a revoked certificate read "SSL_ERROR_RX_MALFORMED_SERVER_HELLO") |
+| `0061-layout-the-GPU-path-s-root-displayport-base-is-the-d.patch` | `layout/base/nsLayoutUtils.{h,cpp}`, `layout/generic/nsGfxScrollFrame.cpp` | T-527: on the GPU path the root's displayport base set by the daemon (0059's `jihad_layout_set_displayport2`) is kept by the paint (`nsLayoutUtils::JihadKeepsDisplayPortBase`): `nsLayoutUtils::PaintFrame`'s `DecideScrollableLayer` replaced it on every paint with the composition size at the origin in CSS px, and a zoomed-in card's first paint without margins covered 660 of the 531..861 CSS px shown (`docs/rounds/t527-2026-10-25/notes.txt`) |
+| `0062-gpu-compositor-a-tall-band-surface-for-a-change-that.patch` | `gfx/gl/GLContextEGL.h`, `gfx/gl/GLContextProviderEGL.cpp`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (R8): a change that does not fit the 256-row band surface takes a second, 512-row band surface (`JIHAD_GPU_BAND_TALL`, its own pbuffer and target) instead of the frame-sized target; frames are packed for the band surface first. The 480 px WebGL cube's job 15-30 ms where it took ~45 |
+| `0063-widget-a-GPU-path-layer-paint-with-nothing-pending-i.patch` | `widget/PuppetWidget.{h,cpp}`, `layout/base/nsLayoutUtils.cpp` | T-527: the daemon's layer paint returns at once after the first when nothing is pending (no invalid region, no paint task, no view-manager flush owed): the display list is not built again for nothing (`JIHAD_GPU_PAINT_ALWAYS=1`: every time); a moved displayport base schedules the root's paint (the margins' comparison saw no change). Desktop Wikipedia's pan 23.6 fps and the long page's 33.1, verify 0 rows wrong: the compositor thread stays the bound |
+| `0064-gpu-compositor-a-band-surface-that-cannot-be-made-at.patch` | `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (review): a band surface or its target that cannot be made at a width is not made again every band frame (a line each into /var); the frame's own surface does the pass |
+| `0065-widget-the-layer-paint-skip-repaints-after-a-resolut.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-527 (review 2026-10-26): 0064's skip repaints when the pres shell's resolution differs from the one painted (SetResolution schedules no paint, and a page with no root scroll frame — about:addons — stayed at the old resolution after a zoom across 1.1) and asks the whole widget chain (invalidations land on the child); 0065's failed band surface is tried again after 30 s |
+| `0066-gpu-compositor-a-compose-that-asks-for-its-bands-onl.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-516: compose flag 16 — read only the bands asked for, not the rows the tree changed (still reported); the daemon's first frame at a new zoom reads the card's view alone (942 of 1224 rows): double taps by finger 40/40 within 250 ms, the slowest 227 ms where 276-301 |
+| `0067-gpu-compositor-a-frame-s-fixed-and-stuck-rects-go-ba.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-544: `jihad_offscreen_compose_poll2` returns a frame's fixed and stuck rects with its poll; the daemon passes them to the card (`JihadStuckBlock`), which holds desktop Wikipedia's sticky sidebars still between frames of a pan (they moved with the page and jumped back) |
+| `0068-gpu-compositor-the-overview-s-windows-and-parts-the-.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/composite/AsyncCompositionManager.{h,cpp}` | T-504: compose flags 32 and 64 (`jihad_offscreen_overview_ok`) — an overview window (fixed and stuck layers at opacity 0, cleared transparent, read with its alpha, so rows no tile covered read alpha 0) and the overview's parts (only the fixed and stuck layers, with their alpha); a fixed sticky probe for both, and the verify guard keeps the probe's state; the daemon stitches a half-size picture of the page around a zoom-in point for a double tap out after a pan |
+| `0069-gpu-compositor-a-frame-without-its-parts-flag-128-an.patch` | `widget/PuppetWidget.cpp`, `gfx/layers/opengl/CompositorOGL.h`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}`, `gfx/layers/ipc/CompositableTransactionParent.cpp` | T-505: compose flag 128 (`jihad_offscreen_overview_ok` answers 2) — a frame without its parts: every fixed and sticky layer at opacity 0 in the composite and the diff, no fixed rows, keeps or columns, each part reported as its layer's whole rect; the parts' generation (compositable updates under a fixed or sticky layer) as the poll's thirtieth int; `JIHAD_GPU_REQLOG=1` names each composite request's source |
+| `0070-gpu-compositor-the-diff-leaves-the-card-s-scroll-out.patch` | `gfx/layers/ipc/CompositorBridgeParent.cpp` | T-505: the diff leaves the card's scroll out of a frame with no base to copy (built on its slot's own frame) too, kept only when the shift it measured is the card's since the last composite; a layer transaction during a pan is no longer the whole frame changed for such frames |
+| `0071-gpu-compositor-the-parts-picture-in-the-frame-s-own-.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}`, `gfx/layers/composite/LayerManagerComposite.{h,cpp}` | T-505 (E2): `jihad_offscreen_compose_post2`/`start2` (`overview_ok` answers 3): a frame without its parts reads the parts' picture in its own job when their signature (layers, content, attributes, sizes) is not the daemon's — the parts alone, packed on the band surface, read with their alpha; the poll's 49 ints (signature, the pass's bytes, flags: a content layer above a part / too big, the card's hold set); no column reads without the parts; 0071 only without the parts or without fixed rects |
+| `0072-gpu-compositor-a-frame-without-its-parts-composes-th.patch` | `gfx/layers/composite/LayerManagerComposite.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.{h,cpp}` | T-505: a frame without its parts reads the changed rows whole, so its diff-driven partial composite covers them across the frame's width (`JihadWholeRows`; the columns beside a narrow change used to be the window target's last composite: the long page's wrong verify frame, 2026-11-02); the inspector's review fixes: one sample time per job, fixed rects joined again after the reduction, the parts' signature over a cut part's slice, every part's clip and mask, blend modes as covered; the parts pass under the job's cancel flag |
 | `0054-gpu-compositor-kept-rects-all-saved-before-any-is-wr.patch` | `gfx/layers/opengl/CompositorOGL.cpp`, `widget/PuppetWidget.cpp`, `dom/canvas/WebGLContext.cpp`, `widget/headless/GfxInfo.cpp` | T-517/T-511 review: a window-moved shift saves every kept rect before writing any; `jihad_offscreen_gpu_given_up()` / `jihad_gpu_compositor_on()`, so WebGL makes no EGL contexts once the daemon has given the GPU path up |
 | `0053-gpu-compositor-a-shift-that-is-the-daemon-s-window-m.patch` | `gfx/layers/opengl/CompositorOGL.{h,cpp}`, `widget/PuppetWidget.cpp` | T-517: a compose job's shift may be the daemon's move of the frame's window in its segment (flag 8): the rows are in place, only the kept rects are copied from where they were |
 | `0052-gpu-compositor-the-frame-s-bands-read-as-one-column-.patch` | `widget/PuppetWidget.{h,cpp}`, `gfx/layers/ipc/CompositorBridgeParent.cpp`, `gfx/layers/opengl/CompositorOGL.{h,cpp}` | T-511: a compose job may give its bands' stale columns (flag 4); with no shift, kept rows or fixed columns, the bands are read as the one column the change and they span when it is under three quarters of the width; the poll reports the change's columns (twelve ints); `JIHAD_GPU_NO_COLUMN_READ=1` reads whole rows |

+### The move to RB_20261027 (2026-11-03)
+
+`update-engine.sh RB_20261027` / `--finish` (docs/ENGINE.md §6): 12 upstream commits since RB_20261006, 11 files,
+one overlapping the queue (`certdata.txt`, patch 0060, byte-identical — dropped, above). The owner's word (2026-11-02):
+the certificate and HTTPS changes get special attention. Each commit and its disposition:
+
+| Upstream commit | What it changes | Disposition |
+|---|---|---|
+| `037cc5f614` `[NSS] Remove emSign roots (eMudhra compromise)` | `security/nss/lib/ckfw/builtins/certdata.txt` | certificate: taken with the base; the device had it since 2026-10-25 through patch 0060 (now dropped); `audit-roots.py` 0 findings against the base |
+| `4a68bbbd53` `[NSS] Update certdata to Sept 2026 status` | `certdata.txt` | certificate: the same |
+| `6b18be917d` `[js] Avoid OOB array copy` | `js/src/vm/SelfHosting.cpp` | memory safety: taken; the desktop JS-driven tests and the device checklist |
+| `d42616bb12` Remove the `URI_LOADABLE_BY_ANYONE` flag from the `jar:` protocol | `modules/libjar/nsJARProtocolHandler.cpp` | security hardening: taken; Jihad's own `jar:` pages (about:settings, about:personas, the start pages, the add-on pane) checked on the device |
+| `bae7a6ec8f` `[gfx] Prevent feTile rect calculations from overflowing` | `gfx/2d/FilterNodeSoftware.cpp` | memory safety: taken; an SVG filter page on the device |
+| `8fea2ad823` `[layout] Ensure frame table is valid after adjusting selection` | `layout/generic/nsSelection.cpp` | memory safety: taken; selection on the device |
+| `c4339b14dc` Use strong ref for animation mutation observer batch targets | `dom/base/nsDOMMutationObserver.h` | memory safety: taken |
+| `e86caa48f5` `[XPCOM] Lock during nsComponentManager memory reports` | `xpcom/components/nsComponentManager.{h,cpp}` | taken |
+| `5762097bc2` Update SQLite lib to 3.54.1 | `db/sqlite3/src/sqlite3.{c,h}` | taken; cookies and history across the update checked on the device |
+| `612a8991df`, `38e09d2368`, `5c991eadc0` the executable extensions list | `xpcom/io/nsLocalFileWin.cpp` | Windows only: no effect here |
+
+No PSM, TLS protocol, HSTS or certificate-UI change is in the range; Jihad's TLS floor (patch 0060, formerly 0061)
+and the Trust dialog's error gate apply unchanged.
+
 ### Branding strip (cavekit-licensing-branding R3) — patch 0010

 Part of the engine branch since the patch series was committed (patch 0010; it was once a `sed`
@@ -0,0 +1,11 @@
+engine: third_party/uxp/security/nss/lib/ckfw/builtins/certdata.txt
+  169 certificates, 118 trusted for server authentication
+  incident CAs by name (read each): COMODO Certification Authority; COMODO ECC Certification Authority; COMODO RSA Certification Authority; Comodo AAA Services root; Entrust Root Certification Authority - EC1; Entrust Root Certification Authority - G2; Entrust Root Certification Authority - G4; Entrust.net Premium 2048 Secure Server CA; GlobalSign ECC Root CA - R4; GlobalSign ECC Root CA - R5; GlobalSign Root CA; GlobalSign Root CA - R3; GlobalSign Root CA - R6; GlobalSign Root E46; GlobalSign Root R46; GlobalSign Secure Mail Root E45; GlobalSign Secure Mail Root R45; Izenpe.com
+removed report: docs/rounds/certs-2026-11-03/removed-ca-report.csv (106 rows)
+  none of the engine's roots is on it
+platform import's removed list fetched 2026-10-25, 106 roots
+platform import's list: render/goanna/certs/jihad-cert-lists.json — 106 of the report's 106 roots present
+reference: docs/rounds/certs-2026-11-03/uxp-release-certdata.txt
+  169 certificates, 118 trusted for server authentication
+  identical set and trust
+RESULT: OK
@@ -0,0 +1,159 @@
+"Owner","Certificate Issuer Organization","Certificate Issuer Organizational Unit","Root Certificate Name","NSS Release When Removed","Firefox Release When Removed","Certificate Serial Number","SHA-256 Fingerprint","Subject + SPKI SHA256","Valid From [GMT]","Valid To [GMT]","Public Key Algorithm","Signature Hash Algorithm","Trust Bits","EV Policy OID(s)","Removal Bug No. or Date","Approval Bug","NSS Release When First Included","Firefox Release When First Included","Company Website","Comments"
+"AC Camerfirma, S.A.","AC Camerfirma SA CIF A82743287","http://www.chambersign.org","Chambers of Commerce Root","NSS 3.92","Firefox 117","00","0C258A12A5674AEF25F28BA7DCFAECEEA348E541E6F5CC4EE63B71B361606AC3","BC2FD9EA61581CB22BB859690D61430E7D222D1119E8C41649B9B1D556D439A4","2003.09.30","2037.09.30","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1827224","https://bugzilla.mozilla.org/show_bug.cgi?id=261778","","Firefox 1","http://www.camerfirma.com","Websites trust bit turned off in NSS 3.35, Firefox 59
+https://bugzilla.mozilla.org/show_bug.cgi?id=1410277"
+"AC Camerfirma, S.A.","AC Camerfirma S.A.","","Chambers of Commerce Root - 2008","NSS 3.94","Firefox 121","00A3DA427EA4B1AEDA","063E4AFAC491DFD332F3089B8542E94617D893D7FE944E10A7937EE29D9693C0","849AD3279D9B805A288339468C417744AC1CE2758A6E283A446685384D5D6CD2","2008.08.01","2038.07.31","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1850982","https://bugzilla.mozilla.org/show_bug.cgi?id=406968","NSS 3.12.9","Firefox 4.0","http://www.camerfirma.com","Temporarily re-enabled the Websites trust bit via https://bugzilla.mozilla.org/show_bug.cgi?id=1703090 for Firefox 88, i.e. delayed turning off the trust bit to Firefox 89.
+Turning off Websites trust bit via https://bugzilla.mozilla.org/show_bug.cgi?id=1692094.
+Disabling EV treatment via https://bugzilla.mozilla.org/show_bug.cgi?id=1692101."
+"AC Camerfirma, S.A.","AC Camerfirma SA CIF A82743287","http://www.chambersign.org","Global Chambersign Root","NSS 3.83","Firefox 106","00","EF3CB417FC8EBF6F97876C9E4ECE39DE1EA5FE649141D1028B7D11C0B2298CED","F33BD6DDC7576A7AC9BBA464D7425F26D58FD2C51A3A1F89878D5262BDD485E0","2003.09.30","2037.09.30","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1778412","https://bugzilla.mozilla.org/show_bug.cgi?id=261778","","Firefox 1","http://www.camerfirma.com","Websites trust bit turned off in NSS 3.35, Firefox 59
+https://bugzilla.mozilla.org/show_bug.cgi?id=1410277"
+"AC Camerfirma, S.A.","AC Camerfirma S.A.","","Global Chambersign Root - 2008","NSS 3.94","Firefox 121","00C9CDD3E9D57D23CE","136335439334A7698016A0D324DE72284E079D7B5220BB8FBD747816EEBEBACA","7DB0C6863B891672A51E9D28B42610F1DB9F5651C8C87736B937536F8453F947","2008.08.01","2038.07.31","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1850982","https://bugzilla.mozilla.org/show_bug.cgi?id=406968","NSS 3.12.9","Firefox 4.0","http://www.camerfirma.com","Turned the Websites trust bit back on via https://bugzilla.mozilla.org/show_bug.cgi?id=1703090
+Turning of Websites trust bit via https://bugzilla.mozilla.org/show_bug.cgi?id=1692094.
+Disabled EV treatment via https://bugzilla.mozilla.org/show_bug.cgi?id=1585449."
+"AOL","America Online Inc.","","America Online Root Certification Authority 1","NSS 3.17.3","Firefox 36","01","77407312C63A153D5BC00B4E51759CDFDAC237DC2A33B67946E98E9BFA680AE3","CCD47D1E44A99DEECA1220B20489D15B07A90FEABFEA148BD807175AB9E66C54","2002.05.28","2037.11.19","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1083294","legacy","","Firefox 1","http://pki-info.aol.com/AOL/",""
+"AOL","America Online Inc.","","America Online Root Certification Authority 2","NSS 3.17.3","Firefox 36","01","7D3B465A6014E526C0AFFCEE2127D2311727AD811C26842D006AF37306CC80BD","9B398EA3399ECAF6B07C94D70EC5C3DB42F26B7D95A6800ABBA00D5D05F0EC1A","2002.05.28","2037.09.29","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1083294","legacy","","Firefox 1","http://pki-info.aol.com/AOL/",""
+"ARRIS Technology, Inc.","CommScope","","CommScope Public Trust ECC Root-01","3.118","146","43708277CF4D5D34F1CAAE322F37F7F47F75A09E","11437CDA7BB45E41365F45B39A38986B0DE00DEF348E0C7BB0873633800BC38B","41DDECE14AD35753E3C68A2FF7FEE1B4907087758AAB07F638A67442DD5D35E6","2021.04.28","2046.04.28","EC secp384r1","ecdsaWithSHA384","","","1994866","https://bugzilla.mozilla.org/show_bug.cgi?id=1763177","NSS 3.94","Firefox 121","https://www.pki-center.com/","CommScope's CP/CPS covers also CAs that do not issue publicly-trusted certificates. The information provide here about what CommScope's CP/CPS permits or not is based on CommScope's CP/CPS as it applies to CAs involved in the issuance of publicly-trusted certificates."
+"ARRIS Technology, Inc.","CommScope","","CommScope Public Trust ECC Root-02","3.118","146","28FD99604147A6013ACA147B1FEFF96808835D7D","2FFB7F813BBBB3C89AB4E8162D0F16D71509A830CC9D73C262E5140875D1AD4A","B464E5EE82EDC92FDDC143E996B722C9D499F1EBABFBC0F250CE6D2DF9B139A6","2021.04.28","2046.04.28","EC secp384r1","ecdsaWithSHA384","","","1994866","https://bugzilla.mozilla.org/show_bug.cgi?id=1763177","NSS 3.94","Firefox 121","https://www.pki-center.com/","CommScope's CP/CPS covers also CAs that do not issue publicly-trusted certificates. The information provide here about what CommScope's CP/CPS permits or not is based on CommScope's CP/CPS as it applies to CAs involved in the issuance of publicly-trusted certificates."
+"ARRIS Technology, Inc.","CommScope","","CommScope Public Trust RSA Root-01","3.118","146","3E034981751674318E4CABD5C5902996C53910DD","02BDF96E2A45DD9BF18FC7E1DBDF21A0379BA3C9C2610344CFD8D606FEC1ED81","B992334E632E7344D71733FE045C8C5BA9779968E1A6137619D88C85C305FDE1","2021.04.28","2046.04.28","RSA 4096 bits","SHA256WithRSA","","","1994866","https://bugzilla.mozilla.org/show_bug.cgi?id=1763177","NSS 3.94","Firefox 121","https://www.pki-center.com/","CommScope's CP/CPS covers also CAs that do not issue publicly-trusted certificates. The information provide here about what CommScope's CP/CPS permits or not is based on CommScope's CP/CPS as it applies to CAs involved in the issuance of publicly-trusted certificates."
+"ARRIS Technology, Inc.","CommScope","","CommScope Public Trust RSA Root-02","3.118","146","5416BF3B7E3995718DD1AA00A5860D2B8F7A054E","FFE943D793424B4F7C440C1C3D648D5363F34B82DC87AA7A9F118FC5DEE101F1","8001F1CE077595B26968F85EFA9CB8E8F441CB527D024F4BE1500420B7466EB1","2021.04.28","2046.04.28","RSA 4096 bits","SHA256WithRSA","","","1994866","https://bugzilla.mozilla.org/show_bug.cgi?id=1763177","NSS 3.94","Firefox 121","https://www.pki-center.com/","CommScope's CP/CPS covers also CAs that do not issue publicly-trusted certificates. The information provide here about what CommScope's CP/CPS permits or not is based on CommScope's CP/CPS as it applies to CAs involved in the issuance of publicly-trusted certificates."
+"Autoridad de Certificacion Firmaprofesional","","","Autoridad de Certificacion Firmaprofesional CIF A62634068","NSS 3.94","Firefox 121","53EC3BEEFBB2485F","04048028BF1F2864D48F9AD4D83294366A828856553F3B14303F90147F5D40EF","B5DAFFA4766010AC1693044AFF780C954BC71DBE5ABB16E3ADA0DCC6C7FE550F","2009.05.20","2030.12.31","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1842935","https://bugzilla.mozilla.org/show_bug.cgi?id=521439","NSS 3.12.9","Firefox 4.0","http://www.firmaprofesional.com/","Qualified audit: Fields in SAN that were required by Spanish law, Coding  of jurisdictionOfIncorporation in UTF8, OCSP responder respond with a good status when receives a request for status of a certificate that has not been issued."
+"Autoridad de Certificacion Firmaprofesional","Firmaprofesional SA","","FIRMAPROFESIONAL CA ROOT-A WEB","3.123","151","319721EDAF89427F354187A167564C6D","BEF256DAF26E9C69BDEC1602359798F3CAF71821A03E018257C53C65617F3D4A","C4628CA1B3C6BA6A9B2F063BD0557A37319AAAFA1B4B1DEBCE68A5678807E28E","2022.04.06","2047.03.31","EC secp384r1","ecdsaWithSHA384","","","2027847","","NSS 3.101","FF 128","http://www.firmaprofesional.com/",""
+"Certicámara","Sociedad Cameral de Certificación Digital - Certicámara S.A.","","AC Raíz Certicámara S.A.","NSS 3.41","Firefox 65","077E52937BE015E357F0698CCBEC0C","A6C51E0DA5CA0A9309D2E4C0E40C2AF9107AAE8203857FE198E3E769E343085C","2265A872134D2AACCA1CEE045000F75356F38326D5A1C8BC70BCAF58983DB6B9","2006.11.27","2030.04.02","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1501457","https://bugzilla.mozilla.org/show_bug.cgi?id=401262","NSS 3.12.4","Firefox 3.5","http://www.certicamara.com","Websites trust bit turned off in Firefox 32.
+https://bugzilla.mozilla.org/show_bug.cgi?id=1013572
+
+Plan to create a new SHA2 root in 2016, and finish migrating to it in 2018."
+"certSIGN","certSIGN","certSIGN ROOT CA","certSIGN ROOT CA","3.123","151","200605167002","EAA962C4FA4A6BAFEBE415196D351CCD888D4F53F3FA8AE6D7C466A94E6042BB","803207093030E6DA4EAF69969EDD5A4F9B2A4685B497A283BC4AEEBCA2A04361","2006.07.04","2031.07.04","RSA 2048 bits","SHA1WithRSA","","","2017468","https://bugzilla.mozilla.org/show_bug.cgi?id=470756","NSS 3.12.5","Firefox 3.6","http://www.certsign.ro/certsign_en/","certSIGN already prepared the end-of-life cycle of this root and its intermediate CAs – most of them expiring in June 2025 – and ceased to issue certificates with any of the Intermediate CAs from the beginning of 2024.
+The Secure Email trust bit is not used, and certSIGN have no intention to use it, so certSIGN is asking for the removal of this bit from all ROOT Store Programs (Apple, Microsoft, Mozilla and Chrome)."
+"China Internet Network Information Center (CNNIC)","China Internet Network Information Center","","China Internet Network Information Center EV Certificates Root","NSS 3.32","Firefox 56","489F0001","1C01C6F4DBB2FEFC22558B2BCA32563F49844ACFC32B7BE4B0FF599F9E8C7AF7","FF8A99631AD5A1E71CC441D678DCA68E17409115EA6420F60F2F02477D908E66","2010.08.31","2030.08.31","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1380868","https://bugzilla.mozilla.org/show_bug.cgi?id=607208","NSS 3.15","Firefox 23","http://www1.cnnic.cn/index.htm","https://bugzilla.mozilla.org/show_bug.cgi?id=1177209
+The CNNIC root certificates are currently in a partially disabled state, in which certificates chaining to these roots are only accepted if they were issued before 1 Apr 2015."
+"China Internet Network Information Center (CNNIC)","CNNIC","","CNNIC ROOT","NSS 3.32","Firefox 56","49330001","E28393773DA845A679F2080CC7FB44A3B7A1C3792CB7EB7729FDCB6A8D99AEA7","6C6DAE76368E4BFFD132EF023275C7E86A64BAD3BB69D8ED4EA01F46CC716FD6","2007.04.16","2027.04.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1380868","https://bugzilla.mozilla.org/show_bug.cgi?id=476766","NSS 3.12.6","Firefox 3.6.2","http://www1.cnnic.cn/index.htm","https://bugzilla.mozilla.org/show_bug.cgi?id=1177209
+The CNNIC root certificates are currently in a partially disabled state, in which certificates chaining to these roots are only accepted if they were issued before 1 Apr 2015."
+"Chunghwa Telecom","Chunghwa Telecom Co., Ltd.","ePKI Root Certification Authority","ePKI Root Certification Authority","3.126","154","15C8BD65475CAFB897005EE406D2BC9D","C0A6F4DC63A24BFDCF54EF2A6A082A0A72DE35803E2FF5FF527AE5D87206DFD5","5F7314B8C34C1932B5A414A24494606BF760654A7F11562BA2845E81AD19A9D0","2004.12.20","2034.12.20","RSA 4096 bits","SHA1WithRSA","","","2052097","https://bugzilla.mozilla.org/show_bug.cgi?id=448794","NSS 3.12.5","Firefox 3.6","http://www.cht.com.tw","Chunghwa Telecom has decided to retire this root certificate and will no longer issue any certificates under it."
+"ComSign","ComSign","","ComSign CA","NSS 3.39","Firefox 63","1413968314558CEA7B63E5FC34877744","AE4457B40D9EDA96677B0D3C92D57B5177ABD7AC1037958356D1E094518BE5F2","9C20480700BC0386300B15951395C04DD64709F54EDA5CD0488FA2CF2AF8CDAE","2004.03.24","2029.03.19","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1462098","https://bugzilla.mozilla.org/show_bug.cgi?id=420705","NSS 3.12.4","Firefox 3.5","http://www.comsign.co.il/eng/default.asp",""
+"ComSign","ComSign","","ComSign Secured CA","NSS 3.32","Firefox 56","00C7284709B3B86C458C1DFA24F5364EE9","507941C74460A0B47086220D4E9932572AB5D1B5BBCB8980AB1CB17651A844D2","1F9EB68A23DB33A76F616E35C289C2A120A7895C4F76AA09996531A3DD4B5CE0","2004.03.24","2029.03.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1366412","https://bugzilla.mozilla.org/show_bug.cgi?id=420705","NSS 3.12.4","Firefox 3.5","http://www.comsign.co.il/eng/default.asp","Websites trust bit turned off  in Firefox 42, NSS 3.19.3"
+"Consorci Administració Oberta de Catalunya (Consorci AOC, CATCert)","Agencia Catalana de Certificacio (NIF Q-0801176-I)","Serveis Publics de Certificacio, Vegeu https://www.catcert.net/verarrel (c)03, Jerarquia Entitats de Certificacio Catalanes","EC-ACC","NSS 3.86","Firefox 109","EE2B3DEBD421DE14A862AC04F3DDC401","88497F01602F3154246AE28C4D5AEF10F1D87EBB76626F4AE0B7F95BA7968799","DBAEE5018161205A34C28F9482A9C1D9775D83D161CDE803E3AB3684D8FE1F1C","2003.01.07","2031.01.07","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1797559","https://bugzilla.mozilla.org/show_bug.cgi?id=295474","NSS 3.13.2","Firefox 11","http://epscd.aoc.cat/",""
+"Cybertrust Japan / JCSI","Cybertrust Japan Co., Ltd.","","SecureSign Root CA12","3.125","153","66F9C7C1AFECC251B4ED5397E6E682C32B1C9016","3F034BB5704D44B2D08545A02057DE93EBF3905FCE721ACBC730C06DDAEE904E","09CEEF133F6CB8E0DC2DAC2C1F366168F0AC48C81FD6302EE41390E6C5A5C0F5","2020.04.08","2040.04.08","RSA 2048 bits","SHA256WithRSA","","","2031105","","NSS 3.104","FF 131","https://www.cybertrust.co.jp/",""
+"Cybertrust Japan / JCSI","Japan Certification Services, Inc.","","SecureSign RootCA11","3.107","FF 134","01","BF0FEEFB9E3A581AD5F9E9DB7589985743D261085C4D314F6F5D7259AA421612","629844ED8C5DB0F721561FA3ED72F1780D3C37FFE2F8207CB5B3483A2ED6F217","2009.04.08","2029.04.08","RSA 2048 bits","SHA1WithRSA","","","1918559","https://bugzilla.mozilla.org/show_bug.cgi?id=496863","NSS 3.12.6","Firefox 3.6.2","https://www.cybertrust.co.jp/",""
+"Deutscher Sparkassen Verlag GmbH (S-TRUST, DSV-Gruppe)","Deutscher Sparkassen Verlag GmbH","","S-TRUST Authentication and Encryption Root CA 2005:PN","NSS 3.27","Firefox 51","371918E653547C1AB5B8CB595ADB35B7","37D8DC8AF7867845DA3344A6B1BADE448D8A80E47B5579F96BF631768F9F30F6","76F7E51BE38890D281AC5F421E52CA1FC2385FBE91532E8009E1B44E3F50E454","2005.06.22","2030.06.21","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1286696","https://bugzilla.mozilla.org/show_bug.cgi?id=370627","NSS 3.12.4","Firefox 3.5","https://www.s-trust.de/",""
+"Deutscher Sparkassen Verlag GmbH (S-TRUST, DSV-Gruppe)","Deutscher Sparkassen Verlag GmbH","S-TRUST Certification Services","S-TRUST Universal Root CA","NSS 3.37","Firefox 61","6056C54B23405B64D4ED25DAD9D61E1E","D80FEF910AE3F104723B045CEC2D019F441CE6213ADF156791E70C1790110A31","B32FB909B48695D36404615614E049F89C9E1F4C9E87459A3BF6B07E9C757821","2013.10.22","2038.10.21","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1432959","https://bugzilla.mozilla.org/show_bug.cgi?id=1011182","NSS 3.18","Firefox 38","https://www.s-trust.de/",""
+"DigiCert","GeoTrust Inc.","","GeoTrust Primary Certification Authority","NSS 3.60","Firefox 85","18ACB56AFD69B6153A636CAFDAFAC4A1","37D51006C512EAAB626421F1EC8C92013FC5F82AE98EE533EB4619B8DEB4D06C","0AD748AD619481803A03D372543B42D402BEC6F273323D364E8BCBE6526C4560","2006.11.27","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=407168","NSS 3.11.10","Firefox 3.0.2","https://www.digicert.com/",""
+"DigiCert","GeoTrust Inc.","(c) 2007 GeoTrust Inc. - For authorized use only","GeoTrust Primary Certification Authority - G2","NSS 3.63","Firefox 88","3CB2F4480A00E2FEEB243B5E603EC36B","5EDB7AC43B82A06A8761E8D7BE4979EBF2611F7DD79BF91C1C6B566A219ED766","A073D36CA9EBA1345C9D7FA2780755CDE195186DAA6C99B01CAD94DB2BF236E8","2007.11.05","2038.01.18","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1686854","https://bugzilla.mozilla.org/show_bug.cgi?id=409236","NSS 3.12.6","Firefox 3.6.2","https://www.digicert.com/",""
+"DigiCert","GeoTrust Inc.","(c) 2008 GeoTrust Inc. - For authorized use only","GeoTrust Primary Certification Authority - G3","NSS 3.60","Firefox 85","15AC6E9419B2794B41F627A9C3180F1F","B478B812250DF878635C2AA7EC7D155EAA625EE82916E2CD294361886CD1FBD4","4A3F0BB40C980AFFC2B039F6F0BAC88FBEDBD6A54AECF102291BAF6C07CAAD3B","2008.04.02","2037.12.01","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=484899","NSS 3.12.5","Firefox 3.6","https://www.digicert.com/",""
+"DigiCert","GeoTrust Inc.","","GeoTrust Universal CA","NSS 3.60","Firefox 85","01","A0459B9F63B22559F5FA5D4C6DB3F9F72FF19342033578F073BF1D1B46CBB912","A375D830815CBA5D8DA3B4B1564FBBECB879BD40EE44AAE341CD314A0F42B373","2004.03.04","2029.03.04","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=294916","NSS 3.11.4","Firefox 2","https://www.digicert.com/",""
+"DigiCert","GeoTrust Inc.","","GeoTrust Universal CA 2","NSS 3.60","Firefox 85","01","A0234F3BC8527CA5628EEC81AD5D69895DA5680DC91D1CB8477F33F878B95B0B","8F83F7135B6613E980BD82C690DC845F5F12557BEDB322373BB2097B439BB493","2004.03.04","2029.03.04","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=294916","NSS 3.11.4","Firefox 2","https://www.digicert.com/",""
+"DigiCert","Symantec Corporation","Symantec Trust Network","Symantec Class 1 Public Primary Certification Authority - G4","NSS 3.54","Firefox 79","216E33A5CBD388A46F2907B4273CC4D8","363F3C849EAB03B0A2A0F636D7B86D04D3AC7FCFE26A0A9121AB9795F6E176DF","38BD7D78D1682AF2A071511CC33607D72AFC8DFE39060D97E96089BFDFF1202A","2011.10.05","2038.01.18","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1618402","https://bugzilla.mozilla.org/show_bug.cgi?id=833986","NSS 3.28.1","Firefox 51","https://www.digicert.com/",""
+"DigiCert","Symantec Corporation","Symantec Trust Network","Symantec Class 1 Public Primary Certification Authority - G6","NSS 3.94","Firefox 121","243275F21D2FD20933F7B46ACAD0F398","9D190B2E314566685BE8A889E27AA8C7D7AE1D8AADDBA3C1ECF9D24863CD34B9","D4AC680A231DDF0ED15416C3CCA32E028C0CBD02512B12D9F6E4DE583939BC56","2011.10.18","2037.12.01","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1855318","https://bugzilla.mozilla.org/show_bug.cgi?id=833986","NSS 3.28.1","Firefox 51","https://www.digicert.com/",""
+"DigiCert","Symantec Corporation","Symantec Trust Network","Symantec Class 2 Public Primary Certification Authority - G4","NSS 3.54","Firefox 79","34176512403BB756802D80CB7955A61E","FE863D0822FE7A2353FA484D5924E875656D3DC9FB58771F6F616F9D571BC592","1D3B979CCD463DFA858672C7AF6B8EA47E87D73D6F620F5B6EF80E7D3D6F52C6","2011.10.05","2038.01.18","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1618402","https://bugzilla.mozilla.org/show_bug.cgi?id=833986","NSS 3.28.1","Firefox 51","https://www.digicert.com/",""
+"DigiCert","Symantec Corporation","Symantec Trust Network","Symantec Class 2 Public Primary Certification Authority - G6","NSS 3.94","Firefox 121","64829EFC371E745DFC97FF97C8B1FF41","CB627D18B58AD56DDE331A30456BC65C601A4E9B18DEDCEA08E7DAAA07815FF0","F93FF99D3D2D7BDC7F5F22CF14E47C81018FF2565352BEF8E885956BD2DB70DD","2011.10.18","2037.12.01","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1855318","https://bugzilla.mozilla.org/show_bug.cgi?id=833986","NSS 3.28.1","Firefox 51","https://www.digicert.com/",""
+"DigiCert","TC TrustCenter GmbH","TC TrustCenter Universal CA","TC TrustCenter Universal CA III","NSS 3.21","Firefox 44","632500010002148D331502E46CF4","309B4A87F6CA56C93169AAA99C6D988854D7892BD5437E2D07B29CBEDA55D35D","E0B828D4E69C96135B65EECDDB42A999584EE0D06131F4048B6ED4EBBE723B3F","2009.09.09","2029.12.31","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1204962","https://bugzilla.mozilla.org/show_bug.cgi?id=593063","NSS 3.12.9","Firefox 4.0","https://www.digicert.com/","Root no longer in use"
+"DigiCert","thawte, Inc.","Certification Services Division, (c) 2006 thawte, Inc. - For authorized use only","thawte Primary Root CA","NSS 3.60","Firefox 85","344ED55720D5EDEC49F42FCE37DB2B6D","8D722F81A9C113C0791DF136A2966DB26C950A971DB46B4199F4EA54B78BFB9F","3DC6A0079602409063B020D72676BED736485B09620129C383120130863C9114","2006.11.17","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=407163","NSS 3.11.10","Firefox 3.0.2","https://www.digicert.com/",""
+"DigiCert","thawte, Inc.","(c) 2007 thawte, Inc. - For authorized use only","thawte Primary Root CA - G2","NSS 3.60","Firefox 85","35FC265CD9844FC93D263D579BAED756","A4310D50AF18A6447190372A86AFAF8B951FFB431D837F1E5688B45971ED1557","112633F3DCB6C8735B5B0DCB9616B86CD26DAB9DC7039756EEC29637ECF4D82E","2007.11.05","2038.01.18","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=409237","NSS 3.12.6","Firefox 3.6.2","https://www.digicert.com/",""
+"DigiCert","thawte, Inc.","Certification Services Division, (c) 2008 thawte, Inc. - For authorized use only","thawte Primary Root CA - G3","NSS 3.60","Fireox 85","600197B746A7EAB4B49AD64B2FF790FB","4B03F45807AD70F21BFC2CAE71C9FDE4604C064CF5FFB686BAE5DBAAD7FDD34C","04029026491D69AED10E10EB031CCAA4F4965049DBC07F456C51ED1F378AAB4E","2008.04.02","2037.12.01","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=484903","NSS 3.12.5","Firefox 3.6","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","Class 1 Public Primary Certification Authority","VeriSign Class 1 Public PCA","NSS 3.27","Firefox 51","3F691E819CF09A4AF373FFB948A2E4DD","51847C8CBD2E9A72C91E292D2AE247D7DE1E3FD270547A20EF7D610F38B8842C","C41BCDB9D7B1620DFC9DF027BB27A6521C42002CCBED199DF6EDD2E8EF153C34","1996.01.29","2028.08.02","RSA 1024 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1288250","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","Class 1 Public Primary Certification Authority - G2, (c) 1998 VeriSign, Inc. - For authorized use only, VeriSign Trust Network","VeriSign Class 1 Public PCA – G2","NSS 3.23","Firefox 46","4CC7EAAA983E71D39310F83D3A899192","341DE98B1392ABF7F4AB90A960CF25D4BD6EC65B9A51CE6ED067D00EC7CE9B7F","36128D50756C86A3599AB648080322D7A61C1BB735931B499057EC3BEF713276","1998.05.18","2028.08.01","RSA 1024 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1237817","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/","Retired"
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only","VeriSign Class 1 Public Primary Certification Authority - G3","NSS 3.94","Firefox 121","008B5B75568454850B00CFAF3848CEB1A4","CBB5AF185E942A2402F9EACBC0ED5BB876EEA3C1223623D00447E4F3BA554B65","CE63AAADB196370A0323AF847C40E4909CE53F7793180D4893AC3EAEFF3C7972","1999.10.01","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1855318","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","Class 2 Public Primary Certification Authority - G2, (c) 1998 VeriSign, Inc. - For authorized use only, VeriSign Trust Network","VeriSign Class 2 Public Primary Certification Authority - G2","NSS 3.27","Firefox 51","00B92F60CC889FA17A4609B85B706C8AAF","3A43E220FE7F3EA9653D1E21742EAC2B75C20FD8980305BC502CAF8C2D9B41A1","2AE38332E20A07B6DFBC549DFBC96B4B69CE76F4794311B8B3FC421A70F645C1","1998.05.18","2028.08.01","RSA 1024 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1288250","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/","Migrating customers away from this 1024-bit root. https://bugzilla.mozilla.org/show_bug.cgi?id=936105#c2"
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only","VeriSign Class 2 Public Primary Certification Authority - G3","NSS 3.94","Firefox 121","6170CB498C5F984529E7B0A6D9505B7A","92A9D9833FE1944DB366E8BFAE7A95B6480C2D6C6C2A1BE65D4236B608FCA1BB","9F355C654B91AAAD690EC0FF5C06C2827F65B1D4DCBD17E1FC864568A274F3F8","1999.10.01","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1855318","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","Class 3 Public Primary Certification Authority","VeriSign Class 3 Public PCA - MD2","NSS 3.27","Firefox 51","70BAE41D10D92934B638CA7B03CCBABF","E7685634EFACF69ACE939A6B255B7B4FABEF42935B50A265ACB5CB6027E44E70","2C63FD197383F8E1705B6EC4AEA2A4447A1F53570199FFCB46839E43A3F820CE","1996.01.29","2028.08.01","RSA 1024 bits","MD2WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1288250","legacy","","Firefox 1","https://www.digicert.com/","Websites trust bit turned off in Firefox 32."
+"DigiCert","VeriSign, Inc.","Class 3 Public Primary Certification Authority - G2, (c) 1998 VeriSign, Inc. - For authorized use only, VeriSign Trust Network","VeriSign Class 3 Public PCA – G2","NSS 3.23","Firefox 46","7DD9FE07CFA81EB7107967FBA78934C6","83CE3C1229688A593D485F81973C0F9195431EDA37CC5E36430E79C7A888638B","08DACA5371710860D04DE171AD1FB84611DE226C59208F0642A034111116604A","1998.05.18","2028.08.01","RSA 1024 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1237817","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/","Websites and Code Signing trust bits turned off in NSS 3.17.3, Firefox 36."
+"DigiCert","VeriSign, Inc.","Class 3 Public Primary Certification Authority","VeriSign Class 3 Public Primary Certification Authority","NSS 3.23","Firefox 46","3C9131CB1FF6D01B0E9AB8D044BF12BE","A4B6B3996FC2F306B3FD8681BD63413D8C5009CC4FA329C2CCF0E2FA1B140305","2C63FD197383F8E1705B6EC4AEA2A4447A1F53570199FFCB46839E43A3F820CE","1996.01.29","2028.08.02","RSA 1024 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1237817","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/","Websites trust bit turned off in Firefox 32."
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only","VeriSign Class 3 Public Primary Certification Authority - G3","NSS 3.54","Firefox 79","009B7E0649A33E62B9D5EE90487129EF57","EB04CF5EB1F39AFA762F2BB120F296CBA520C1B97DB1589565B81CB9A17B7244","48AEAF5C35E5C43E4930D60458514321EDC1F7B2C21E0760632281AE09C512A6","1999.10.01","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1618402","https://bugzilla.mozilla.org/show_bug.cgi?id=490895","NSS 3.12.8","Firefox 3.6.12","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 2007 VeriSign, Inc. - For authorized use only","VeriSign Class 3 Public Primary Certification Authority - G4","NSS 3.60","Firefox 85","2F80FE238C0E220F486712289187ACB3","69DDD7EA90BB57C93E135DC85EA6FCD5480B603239BDC454FC758B2A26CF7F79","9E492D60F68B82D42E8003C2387932E7B1180EF867B135BA4C0E7AAC15B5EC7D","2007.11.05","2038.01.18","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=409235","NSS 3.12.6","Firefox 3.6.2","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 2006 VeriSign, Inc. - For authorized use only","VeriSign Class 3 Public Primary Certification Authority - G5","NSS 3.60","Firefox 85","18DAD19E267DE8BB4A2158CDCC6B3B4A","9ACFAB7E43C8D880D06B262A94DEEEE4B4659989C3D0CAF19BAF6405E41AB7DF","09E9E469F981C8F10C494D3B20822F41E8E1586A31405BC8561A8609AFAA24A1","2006.11.08","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1670769","https://bugzilla.mozilla.org/show_bug.cgi?id=402947","NSS 3.11.10","Firefox 3.0.2","https://www.digicert.com/",""
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 1999 VeriSign, Inc. - For authorized use only","VeriSign Class 4 Public Primary Certification Authority - G3","NSS 3.21","Firefox 44","00ECA0A78B6E756A01CFC47CCC2F945ED7","E389360D0FDBAEB3D250584B4730314E222F39C156A020144E8D960561791506","E2E8152D410222B977B992B69249C7621D3A75C7376179FB4E284E3CA9DEB7C6","1999.10.01","2036.07.16","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1190946","legacy","","Firefox 1","https://www.digicert.com/","Root certificate is not in use and CA has no plans to use it."
+"DigiCert","VeriSign, Inc.","VeriSign Trust Network, (c) 2008 VeriSign, Inc. - For authorized use only","VeriSign Universal Root Certification Authority","NSS 3.63","Firefox 88","401AC46421B31321030EBBE4121AC51D","2399561127A57125DE8CEFEA610DDF2FA078B5C8067F4E828290BFB860E84B3C","95CFF1062FF431C179C0D5BF1D2E09A9C551EA17CC85960CE8D13F57485191B2","2008.04.02","2037.12.01","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1686854","https://bugzilla.mozilla.org/show_bug.cgi?id=484901","NSS 3.12.5","Firefox 3.6","https://www.digicert.com/",""
+"Disig, a.s.","Disig a.s.","","CA Disig Root R1","NSS 3.35","Firefox 59","00C3039AEE50906E28","F96F23F4C3E79C077A46988D5AF5900676A0F039CB645DD17549B216C82440CE","1050146FE63A545F2AEF5C60770133E15465631590099BE2C1AB4715CA5C9C2A","2012.07.19","2042.07.19","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1421810","https://bugzilla.mozilla.org/show_bug.cgi?id=792377","NSS 3.15","Firefox 23","https://eidas.disig.sk/en/cacert/","CA is retiring this root certificate, and there are no valid end-entity certificates chaining to this root."
+"Docaposte Certinomis SAS","Certinomis","0002 433998903","Certinomis - Autorité Racine","NSS 3.34","Firefox 58","01","FCBFE2886206F72B27593C8B070297E12D769ED10ED7930705A8098EFFC14D17","78FBCE7C990E0AACCA35FD13D353EA5F20184CC5DC47011501DD06C6F7824100","2008.09.17","2028.09.17","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1400021","https://bugzilla.mozilla.org/show_bug.cgi?id=545614","NSS 3.12.11","Firefox 6.0.2","http://www.certinomis.fr",""
+"Docaposte Certinomis SAS","Certinomis","0002 433998903","Certinomis - Root CA","NSS 3.45","Firefox 69","01","2A99F5BC1174B73CBB1D620884E01C34E51CCB3978DA125F0E33268883BF4158","BD324D052D88E15121ED71A6F9DA9221A985C13144E214DC7D89B54E4721CE65","2013.10.21","2033.10.21","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1552374","https://bugzilla.mozilla.org/show_bug.cgi?id=937589","NSS 3.19.3","Firefox 42","http://www.certinomis.fr",""
+"DocuSign (OpenTrust/Keynectis)","Certplus","","Certplus Root CA G1","NSS 3.41","Firefox 65","11205583E42D3E5456852D8337B72CDC4611","152A402BFCDF2CD548054D2275B39C7FCA3EC0978078B0F0EA76E561A6C7433E","EE19D35BF13938273C933B7F0FA92F5B9EC03F1118CC4EFAB00619A87EE95F33","2014.05.26","2038.01.15","RSA 4096 bits","SHA512WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1499320","https://bugzilla.mozilla.org/show_bug.cgi?id=1025095","NSS 3.25","Firefox 49","https://www.opentrustdtm.com/","Mozilla turned off Websites trust bit via 
+https://bugzilla.mozilla.org/show_bug.cgi?id=1465625
+Mozilla EV treatment turned off in Firefox 63 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1476473"
+"DocuSign (OpenTrust/Keynectis)","Certplus","","Certplus Root CA G2","NSS 3.41","Firefox 65","1120D991CEAEA3E8C5E7FFE902AFCF73BC55","6CC05041E6445E74696C4CFBC9F80F543B7EABBB44B4CE6F787C6A9971C42F17","19EC05CD615B29CFEDCBA511D759620C9BA31F1FF1C985C7373C8D4BE9128588","2014.05.26","2038.01.15","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1499320","https://bugzilla.mozilla.org/show_bug.cgi?id=1025095","NSS 3.25","Firefox 49","https://www.opentrustdtm.com/","Mozilla turned off Websites trust bit via 
+https://bugzilla.mozilla.org/show_bug.cgi?id=1465625
+Mozilla EV treatment turned off in Firefox 63 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1476473"
+"DocuSign (OpenTrust/Keynectis)","OpenTrust","","OpenTrust Root CA G1","NSS 3.41","Firefox 65","1120B39055397D7F366D64C2A79F6B638E67","56C77128D98C18D91B4CFDFFBC25EE9103D4758EA2ABAD826A90F3457D460EB4","79F00B771733392BF56081EBDDDDE8F8878311B3074A409C1D0CC284D6F281BD","2014.05.26","2038.01.15","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1499320","https://bugzilla.mozilla.org/show_bug.cgi?id=1025095","NSS 3.25","Firefox 49","https://www.opentrustdtm.com/","Mozilla turned off Websites trust bit via 
+https://bugzilla.mozilla.org/show_bug.cgi?id=1465625
+Mozilla EV treatment turned off in Firefox 63 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1476473"
+"DocuSign (OpenTrust/Keynectis)","OpenTrust","","OpenTrust Root CA G2","NSS 3.41","Firefox 65","1120A1691BBFBDB9BD52968F23E848BF2611","27995829FE6A7515C1BFE848F9C4761DB16C225929257BF40D0894F29EA8BAF2","3CEE65E2C2F58AB66A5D200CB2CD28AAE4FB97360B4F9AEFCFAA98433DACE494","2014.05.26","2038.01.15","RSA 4096 bits","SHA512WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1499320","https://bugzilla.mozilla.org/show_bug.cgi?id=1025095","NSS 3.25","Firefox 49","https://www.opentrustdtm.com/","Mozilla turned off Websites trust bit via 
+https://bugzilla.mozilla.org/show_bug.cgi?id=1465625
+Mozilla EV treatment turned off in Firefox 63 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1476473"
+"DocuSign (OpenTrust/Keynectis)","OpenTrust","","OpenTrust Root CA G3","NSS 3.41","Firefox 65","1120E6F84CFC24B0BE0540ACDA831B34603F","B7C36231706E81078C367CB896198F1E3208DD926949DD8F5709A410F75B6292","E743C765647F20C06230E588ED9EB36418C32A718C5A45258AB53C83F0E4F400","2014.05.26","2038.01.15","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1499320","https://bugzilla.mozilla.org/show_bug.cgi?id=1025095","NSS 3.25","Firefox 49","https://www.opentrustdtm.com/","Mozilla turned off Websites trust bit via 
+https://bugzilla.mozilla.org/show_bug.cgi?id=1465625
+Mozilla EV treatment turned off in Firefox 63 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1476473"
+"e-commerce monitoring GmbH","e-commerce monitoring GmbH","","GLOBALTRUST 2020","3.123","151","5A4BBD5AFB4F8A5BFA65E5","9A296A5182D1D451A2E37F439B74DAAFA267523329F90F9A0D2007C334E23C9A","6645D5A90FC9FF5001D0F90540C209D6D53F1666F540DEB53BF12D8FC0204A14","2020.02.10","2040.06.10","RSA 4096 bits","SHA256WithRSA","","","2020164","https://bugzilla.mozilla.org/show_bug.cgi?id=1627552","NSS 3.66","Firefox 90","https://www.globaltrust.eu","A changeover to single purpose rootCAs is intended"
+"E-Tugra","E-Tugra EBG A.S.","E-Tugra Trust Center","E-Tugra Global Root CA ECC v3","NSS 3.92","Firefox 117","2646197731E14F6F2836DE395186E6D4978822C1","873F4685FA7F563625252E6D36BCD7F16FC24951F264E47E1B954F4908CDCA13","B1721C8B2922E72D76264C95C12A5DD9E1D1049E0DB6850178EDF8221C1E4D34","2020.03.18","2045.03.12","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1842928","https://bugzilla.mozilla.org/show_bug.cgi?id=1628720","NSS 3.80","Firefox 103","http://www.etugra.com.tr/",""
+"E-Tugra","E-Tugra EBG A.S.","E-Tugra Trust Center","E-Tugra Global Root CA RSA v3","NSS 3.92","Firefox 117","0D4DC5CD16229596087EB80B7F150634FB791034","EF66B0B10A3CDB9F2E3648C76BD2AF18EAD2BFE6F117655E28C4060DA1A3F4C2","3EE27BFF67D090DD8E67848BB0D2083A075898EF71E2F1335563E799C2C393C1","2020.03.18","2045.03.12","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1842928","https://bugzilla.mozilla.org/show_bug.cgi?id=1628720","NSS 3.80","Firefox 103","http://www.etugra.com.tr/",""
+"EDICOM","EDICOM","PKI","ACEDICOM Root","NSS 3.34","Firefox 58","618DC7863B018205","03950FB49A531F3E1991942398DFA9E0EA32D7BA1CDD9BC85DB57ED9400B434A","205CD12A0EA475AF9FB3F57D22C05C783DBE21526B164F6400EE5D42BCB9C0FC","2008.04.18","2028.04.13","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1400013","https://bugzilla.mozilla.org/show_bug.cgi?id=471045","NSS 3.12.7","Firefox 3.6.7","http://acedicom.edicomgroup.com/en/index.htm",""
+"eMudhra Technologies Limited","eMudhra Inc","emSign PKI","emSign ECC Root CA - C3","3.131","160","7B71B68256B8127C9CA8","BC4D809B15189D78DB3E1D8CF4F9726A795DA1643CA5F1358E1DDB0EDC0D7EB3","7787DB2349664D6D38541977225C6CA7429024291F2CAAD5BE9393D26300A04C","2018.02.18","2043.02.18","EC secp384r1","ecdsaWithSHA384","","","2083709","https://bugzilla.mozilla.org/show_bug.cgi?id=1442337","NSS 3.43","Firefox 67","https://www.emudhra.com/",""
+"eMudhra Technologies Limited","eMudhra Technologies Limited","emSign PKI","emSign ECC Root CA - G3","3.132","160","3CF607A968700EDA8B84","86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B","98AD944FA2A5BB2DDDB76050690D9ACFFA4AF0A9684FAB3C1ACC3E5E9CE58425","2018.02.18","2043.02.18","EC secp384r1","ecdsaWithSHA384","","","2084101","https://bugzilla.mozilla.org/show_bug.cgi?id=1442337","NSS 3.43","Firefox 67","https://www.emudhra.com/",""
+"eMudhra Technologies Limited","eMudhra Inc","emSign PKI","emSign Root CA - C1","3.131","160","00AECF00BAC4CF32F843B2","125609AA301DA0A249B97A8239CB6A34216F44DCAC9F3954B14292F2E8C8608F","CCB6CDFECF7DE18D1BD25E88950D436C85195A9176507BBF69883865BDA5360B","2018.02.18","2043.02.18","RSA 2048 bits","SHA256WithRSA","","","2083709","https://bugzilla.mozilla.org/show_bug.cgi?id=1442337","NSS 3.43","Firefox 67","https://www.emudhra.com/",""
+"Entrust","AffirmTrust","","AffirmTrust Commercial","3.123","151","7777062726A9B17C","0376AB1D54C5F9803CE4B2E201A0EE7EEF7B57B636E8A93C9B8D4860C96F5FA7","866456F052487489EE02750771E07C0F1422AC5AC30CCC3ADB9C1B4CCF34BB02","2010.01.29","2030.12.31","RSA 2048 bits","SHA256WithRSA","","","2017460","https://bugzilla.mozilla.org/show_bug.cgi?id=543639","NSS 3.12.10","Firefox 6.0","http://www.entrust.com","Ownership transferred to Entrust on April 28, 2016.
+Transfer of Trend Micro / AffirmTrust Roots to Exclusive Entrust Datacard Control Completed June 7, 2016."
+"Entrust","AffirmTrust","","AffirmTrust Networking","3.123","151","7C4F04391CD4992D","0A81EC5A929777F145904AF38D5D509F66B5E2C58FCDB531058B0E17F3F0B41B","EBD02E0C68BC983B28945E6ED327B6FB93A59CF62764E54912A018445A606EEB","2010.01.29","2030.12.31","RSA 2048 bits","SHA1WithRSA","","","2017460","https://bugzilla.mozilla.org/show_bug.cgi?id=543639","NSS 3.12.10","Firefox 6.0","http://www.entrust.com","Ownership transferred to Entrust on April 28, 2016.
+Transfer of Trend Micro / AffirmTrust Roots to Exclusive Entrust Datacard Control Completed June 7, 2016."
+"Entrust","AffirmTrust","","AffirmTrust Premium","3.123","151","6D8C1446B1A60AEE","70A73F7F376B60074248904534B11482D5BF0E698ECC498DF52577EBF2E93B9A","76297959FB01D1831DD657ACCF26D39CA40E7F650275E3030D4C3AC67BADC69F","2010.01.29","2040.12.31","RSA 4096 bits","SHA384WithRSA","","","2017460","https://bugzilla.mozilla.org/show_bug.cgi?id=543639","NSS 3.12.10","Firefox 6.0","http://www.entrust.com","Ownership transferred to Entrust on April 28, 2016.
+Transfer of Trend Micro / AffirmTrust Roots to Exclusive Entrust Datacard Control Completed June 7, 2016."
+"Entrust","AffirmTrust","","AffirmTrust Premium ECC","3.123","151","7497258AC73F7A54","BD71FDF6DA97E4CF62D1647ADD2581B07D79ADF8397EB4ECBA9C5E8488821423","56C26F47C33DA02AFA6D306E6C8BB2C317369277F6C18984B5F588DD35F867BC","2010.01.29","2040.12.31","EC secp384r1","ecdsaWithSHA384","","","2017460","https://bugzilla.mozilla.org/show_bug.cgi?id=543639","NSS 3.12.10","Firefox 6.0","http://www.entrust.com","Ownership transferred to Entrust on April 28, 2016.
+Transfer of Trend Micro / AffirmTrust Roots to Exclusive Entrust Datacard Control Completed June 7, 2016."
+"Google Trust Services LLC","GlobalSign","GlobalSign ECC Root CA - R4","GlobalSign","NSS 3.74","FF 97","2A38A41C960A04DE42B228A50BE8349802","BEC94911C2955676DB6C0A550986D76E3BA005667C442C9762B4FBB773DE228C","E7BE5BAB85BD4AF554B3C28287CEF885C92126334C0FFC85E6607461B815F162","2012.11.13","2038.01.19","EC secp256r1","ecdsaWithSHA256","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1735407","https://bugzilla.mozilla.org/show_bug.cgi?id=825954","NSS 3.17.3","Firefox 36","https://pki.goog","Ownership transferred to GTS:
+https://bug1325532.bmoattachments.org/attachment.cgi?id=8844281
+Turning off EV treatment for this cert in Firefox 55 via
+https://bugzilla.mozilla.org/show_bug.cgi?id=1349762"
+"Google Trust Services LLC","Google Trust Services LLC","","GTS Root R1","NSS 3.74","FF 97","6E47A9C54B470C0DEC33D089B91CF4E1","2A575471E31340BC21581CBD2CF13E158463203ECE94BCF9D3CC196BF09A5472","1AB88FE2C48A31F5435F3EE3A22F354379CC1E28BDEBB3D1E702ED4817441589","2016.06.22","2036.06.22","RSA 4096 bits","SHA384WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1735407","https://bugzilla.mozilla.org/show_bug.cgi?id=1325532","NSS 3.41","Firefox 65","https://pki.goog",""
+"Google Trust Services LLC","Google Trust Services LLC","","GTS Root R2","NSS 3.74","FF 97","6E47A9C65AB3E720C5309A3F6852F26F","C45D7BB08E6D67E62E4235110B564E5F78FD92EF058C840AEA4E6455D7585C60","0E5C2CB50C8CC27FF4E1C72805073A671BBC51763B8310735C6FEC3BDE93F9EB","2016.06.22","2036.06.22","RSA 4096 bits","SHA384WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1735407","https://bugzilla.mozilla.org/show_bug.cgi?id=1325532","NSS 3.41","Firefox 65","https://pki.goog",""
+"Google Trust Services LLC","Google Trust Services LLC","","GTS Root R3","NSS 3.74","FF 97","6E47A9C76CA9732440890F0355DD8D1D","15D5B8774619EA7D54CE1CA6D0B0C403E037A917F131E8A04E1E6B7A71BABCE5","57D88B417FB78BE305558C964B3663661EFFAF2EB6829D1D317D92001BF66C79","2016.06.22","2036.06.22","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1735407","https://bugzilla.mozilla.org/show_bug.cgi?id=1325532","NSS 3.41","Firefox 65","https://pki.goog",""
+"Google Trust Services LLC","Google Trust Services LLC","","GTS Root R4","NSS 3.74","FF 97","6E47A9C88B94B6E8BB3B2AD8A2B2C199","71CCA5391F9E794B04802530B363E121DA8A3043BB26662FEA4DCA7FC951A4BD","20579A7FA60179758D7F5914C1EDCDA977B8FD70D1CA28A1613FD5FD37EA4591","2016.06.22","2036.06.22","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1735407","https://bugzilla.mozilla.org/show_bug.cgi?id=1325532","NSS 3.41","Firefox 65","https://pki.goog",""
+"Government of Taiwan, Government Root Certification Authority (GRCA)","Government Root Certification Authority","","Government Root Certification Authority","NSS 3.57","Firefox 82","1F9D595AD72FC20644A5800869E35EF6","7600295EEFE85B9E1FD624DB76062AAAAE59818A54D2774CD4C0B2C01131E1B3","3CDFB2A99A19FFB3297BB68CE91BC6E1E8BDCA902134735A0931E712CFFD841F","2002.12.05","2032.12.05","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1656077","https://bugzilla.mozilla.org/show_bug.cgi?id=274106","NSS 3.11.4","Firefox 2","http://grca.nat.gov.tw/01-01.html","Chunghwa Telecom operates both this RDEC Taiwan GRCA and Chunghwa Telecom's ePKI Root Certification Authority. There is no other relation between these two roots."
+"HARICA","Hellenic Academic and Research Institutions Cert. Authority","","Hellenic Academic and Research Institutions RootCA 2011","NSS 3.80","Firefox 103","00","BC104F15A48BE709DCA542A7E1D4B9DF6F054527E802EAA92D595444258AFE71","1FC11D7838792D05CE76753F6DC70A7EADB890B0B03AAF45487CAE5CE35F59C4","2011.12.06","2031.12.01","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1759815","https://bugzilla.mozilla.org/show_bug.cgi?id=581901","NSS 3.13.2","Firefox 11","https://www.harica.gr/",""
+"LuxTrust","LuxTrust S.A.","","LuxTrust Global Root 2","NSS 3.54","Firefox 79","0A7EA6DF4B449EDA6A24859EE6B815D3167FBBB1","54455F7129C20B1447C418F997168F24C58FC5023BF5DA5BE2EB6E1DD8902ED5","42FA1845C15E2540FBDC1318C81FF3206CC47520D3A7612F1AAC7C3AF76DBF3D","2015.03.05","2035.03.05","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1641718","https://bugzilla.mozilla.org/show_bug.cgi?id=944783","NSS 3.28.1","Firefox 51","https://www.luxtrust.lu",""
+"Network Solutions","Network Solutions L.L.C.","","Network Solutions Certificate Authority","NSS 3.86","Firefox 109","57CB336FC25C16E6471617E3903168E0","15F0BA00A3AC7AF3AC884C072B1011A077BD77C097F40164B2F8598ABD83860C","6CA3676B176E34DC6D4B3D352CAC6793C93A6B311646AC0173E050D00A43CCA2","2006.12.01","2029.12.31","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1794495","https://bugzilla.mozilla.org/show_bug.cgi?id=403915","NSS 3.11.10","Firefox 3.0.2","http://www.networksolutions.com/",""
+"SECOM Trust Systems Co., Ltd.","SECOM Trust Systems CO.,LTD.","Security Communication EV RootCA1","Security Communication EV RootCA1","NSS 3.35","Firefox 59","00","A22DBA681E97376E2D397D728AAE3A9B6296B9FDBA60BC2E11F647F2C675FB37","369AA521C1E448B7CC6372D3D69B41F1AEAE603097D67006DBA70CC06A8E1430","2007.06.06","2037.06.06","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1410544","https://bugzilla.mozilla.org/show_bug.cgi?id=394419","NSS 3.12.4","Firefox 3.5","http://www.secomtrust.net/","This root is being retired."
+"SECOM Trust Systems Co., Ltd.","SECOM Trust Systems CO.,LTD.","","Security Communication RootCA3","3.107","FF 134","00E17C3740FD1BFE67","24A55C2AB051442D0617766541239A4AD032D7C55175AA34FFDE2FBC4F5C5294","073BA69009665029D9FCC2413333EBFD5CB7D24D85963B423A3AB0EDD4ED7CE5","2016.06.16","2038.01.18","RSA 4096 bits","SHA384WithRSA","","","1920641","https://bugzilla.mozilla.org/show_bug.cgi?id=1313982","NSS 3.83","Firefox 106","http://www.secomtrust.net/",""
+"Sectigo","Entrust, Inc.","www.entrust.net/CPS is incorporated by reference, (c) 2006 Entrust, Inc.","Entrust Root Certification Authority","3.125","153","456B5054","73C176434F1BC6D5ADF45B0E76E727287C8DE57616C1E6E6141A2B2CBC7D8E4C","45D455E704C234EF5B169B5FEF6626D83BD3BA060F9EA849BCE3BD1363F17B1D","2006.11.27","2026.11.27","RSA 2048 bits","SHA1WithRSA","","","2032223","https://bugzilla.mozilla.org/show_bug.cgi?id=382352","NSS 3.11.10","Firefox 3.0.2","https://sectigo.com/","Root certificate expires in November 2026, as such the root will only be supporting ubiquity until expiry."
+"Sectigo","Comodo CA Limited","","Secure Certificate Services","NSS 3.32","Firefox 56","01","BD81CE3B4F6591D11A67B5FC7A47FDEF25521BF9AA4E18B9E3DF2E34A7803BE8","37336F8B465B72E438EC5304D386FEB10E5F7A7BF37E1C93EC2661BD3AD92DA2","2004.01.01","2028.12.31","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1366403","https://bugzilla.mozilla.org/show_bug.cgi?id=249710","","Firefox 1","https://sectigo.com/",""
+"Sectigo","Comodo CA Limited","","Trusted Certificate Services","NSS 3.32","Firefox 56","01","3F06E55681D496F5BE169EB5389F9F2B8FF61E1708DF6881724849CD5D27CB69","275157ABC787192E2C36A21F2D8155E753F667A9A07E8BFD84EA744A739294A9","2004.01.01","2028.12.31","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1366403","https://bugzilla.mozilla.org/show_bug.cgi?id=249710","","Firefox 1","https://sectigo.com/",""
+"SG Trust Services","SG TRUST SERVICES","0002 43525289500022","SG TRUST SERVICES RACINE","NSS 3.19.3","Firefox 42","3ED55119E64DCE7E","8F1ECDAF29BCD56EDDD6B5D56A07FCAC2B74D4BCD179179144A0365C27DCF14B","4A156F09AD1E51A1E4A8B0BDD9EBB63C724228964C0EA82E0D7B59E5651F0D77","2010.09.06","2030.09.05","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1166025","https://bugzilla.mozilla.org/show_bug.cgi?id=662259","NSS 3.15.4","Firefox 27","http://www.sgtrustservices.com/en/index.htm",""
+"SK ID Solutions AS","AS Sertifitseerimiskeskus","","EE Certification Centre Root CA","NSS 3.57","Firefox 82","5480F9A073ED3F004CCA89D8E371E64A","3E84BA4342908516E77573C0992F0979CA084E4685681FF195CCBA8A229B8A76","676F5DB3D8D0D3AD707AAA869FADEE0ECAC44A5D9AF7CD8DDAC3A35BE9AFE52B","2010.10.30","2030.12.17","RSA 2048 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1651211","https://bugzilla.mozilla.org/show_bug.cgi?id=624356","NSS 3.14","Firefox 18","http://www.sk.ee/","The Server CP states that issuance of the certificates is terminated as of 1. September 2017.
+The last TLS certificate in this CA hierarchy will expire on 29 September 2020."
+"SSL.com","SecureTrust Corporation","","Secure Global CA","3.123","151","075622A4E8D48A894DF413C8F0F8EAA5","4200F5043AC8590EBB527D209ED1503029FBCBD41CA1B506EC27F15ADE7DAC69","BD488A94F09E6F46DEADC161D664E57FA2F797CF6AFCBF7856DFE7B08B3B3473","2006.11.07","2029.12.31","RSA 2048 bits","SHA1WithRSA","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=409838","NSS 3.11.10","Firefox 3.0.2","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"SSL.com","SecureTrust Corporation","","SecureTrust CA","3.123","151","0CF08E5C0816A5AD427FF0EB271859D0","F1C1B50AE5A20DD8030EC9F6BC24823DD367B5255759B4E71B61FCE9F7375D73","662D9472BD6377EEE1EB5ACBE4306B73AF05681963716E28C49F7F456EB3025D","2006.11.07","2029.12.31","RSA 2048 bits","SHA1WithRSA","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=409837","NSS 3.11.10","Firefox 3.0.2","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"SSL.com","Trustwave Holdings, Inc.","","Trustwave Global Certification Authority","3.123","151","05F70E86DA49F346352EBAB2","97552015F5DDFC3C8788C006944555408894450084F100867086BC1A2BB58DC8","69B796C5D9A521195B838FBA0726F3447B1E1C39453DDDFFEE242389E3E4A425","2017.08.23","2042.08.23","RSA 4096 bits","SHA256WithRSA","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=1528369","NSS 3.57","Firefox 82","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"SSL.com","Trustwave Holdings, Inc.","","Trustwave Global ECC P256 Certification Authority","3.123","151","0D6A5F083F285C3E5195DF5D","945BBC825EA554F489D1FD51A73DDF2EA624AC7019A05205225C22A78CCFA8B4","6F57044C314B999399031614C40A83B88D7A4CEDDE0817BCBDE9823A440BCBCA","2017.08.23","2042.08.23","EC secp256r1","ecdsaWithSHA256","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=1528369","NSS 3.57","Firefox 82","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"SSL.com","Trustwave Holdings, Inc.","","Trustwave Global ECC P384 Certification Authority","3.123","151","08BD85976C9927A48068473B","55903859C8C0C3EBB8759ECE4E2557225FF5758BBD38EBD48276601E1BD58097","12F8FF2FF1E91ADFBE97A5DB4D6AA54ADE8959A151D11114D6306971E6E980DC","2017.08.23","2042.08.23","EC secp384r1","ecdsaWithSHA384","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=1528369","NSS 3.57","Firefox 82","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"SSL.com","XRamp Security Services Inc","www.xrampsecurity.com","XRamp Global Certification Authority","3.123","151","50946CEC18EAD59C4DD597EF758FA0AD","CECDDC905099D8DADFC5B1D209B737CBE2C18CFB2C10C0FF0BCF0D3286FC1AA2","9CDCC89B2E898E537BB02FFB25A47FCD52D3BD37601B7D2124D2B8948651A707","2004.11.01","2035.01.01","RSA 2048 bits","SHA1WithRSA","","","2020019","https://bugzilla.mozilla.org/show_bug.cgi?id=273189","NSS 3.10","Firefox 1","https://www.ssl.com/","March 6, 2026:  SSL.com successfully completed the acquisition of the Viking Cloud Digital Certificates business, roots, and keys.  https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/vLeiqf-EYiA"
+"Start Commercial (StartCom) Ltd.","StartCom Ltd.","Secure Digital Certificate Signing","StartCom Certification Authority","NSS 3.34","Firefox 58","01","C766A9BEF2D4071C863A31AA4920E813B2D198608CB7B7CFE21143B836DF09EA","1CFA10A36BD000D255F322A1D281DFFF91BF0CB5C9B434C2130DC00A58BEA787","2006.09.17","2036.09.17","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1392849","https://bugzilla.mozilla.org/show_bug.cgi?id=362304","NSS 3.11.8","Firefox 2","http://www.startssl.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to StartCom CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+StartCom Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311832"
+"Start Commercial (StartCom) Ltd.","StartCom Ltd.","Secure Digital Certificate Signing","StartCom Certification Authority","NSS 3.34","Firefox 58","2D","E17890EE09A3FBF4F48B9C414A17D637B7A50647E9BC752322727FCC1742A911","1CFA10A36BD000D255F322A1D281DFFF91BF0CB5C9B434C2130DC00A58BEA787","2006.09.17","2036.09.17","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1392849","https://bugzilla.mozilla.org/show_bug.cgi?id=602750","NSS 3.13.6","Firefox 16","http://www.startssl.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to StartCom CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+StartCom Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311832"
+"Start Commercial (StartCom) Ltd.","StartCom Ltd.","","StartCom Certification Authority G2","NSS 3.34","Firefox 58","3B","C7BA6567DE93A798AE1FAA791E712D378FAE1F93C4397FEA441BB7CBE6FD5995","8701F10D8E3753FAF8F7A6C97EF06026787116D15E97BA8F83C97C97EC431E80","2010.01.01","2039.12.31","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1392849","https://bugzilla.mozilla.org/show_bug.cgi?id=640368","NSS 3.13.6","Firefox 16","http://www.startssl.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to StartCom CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+StartCom Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311832"
+"Swisscom (Switzerland) Ltd","Swisscom","Digital Certificate Services","Swisscom Root CA 2","NSS 3.46","Firefox 70","1E9E28E848F2E5EFC37C4A1E5A1867B6","F09B122C7114F4A09BD4EA4F4A99D558B46E4C25CD81140D29C05613914C3841","90C0A9B034A12A489B9540B6436DCAE37333D0838ABD82CCB4C8C59BFA8DC7D0","2011.06.24","2031.06.25","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1566569","https://bugzilla.mozilla.org/show_bug.cgi?id=759732","NSS 3.15","Firefox 23","http://www.swissdigicert.ch/sdcs/portal/page?lang=en","Removed Websites trust bit in NSS 3.32, Firefox 56.
+https://bugzilla.mozilla.org/show_bug.cgi?id=1359515
+
+MSFT NotBefore ServerAuth, CodeSign, ClientAuth in Sept2017"
+"Swisscom (Switzerland) Ltd","Swisscom","Digital Certificate Services","Swisscom Root EV CA 2","NSS 3.32","Firefox 56","00F2FA64E27463D38DFD101D041F76CA58","D95FEA3CA4EEDCE74CD76E75FC6D1FF62C441F0FA8BC77F034B19E5DB258015D","09BB8F712C60EFE1EF6C5FAC80CA98A680E58AE1C384F6B2C6FE23F69722724F","2011.06.24","2031.06.25","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1359515","https://bugzilla.mozilla.org/show_bug.cgi?id=759732","NSS 3.15","Firefox 23","http://www.swissdigicert.ch/sdcs/portal/page?lang=en",""
+"SwissSign AG","SwissSign AG","","SwissSign Platinum CA - G2","NSS 3.86","Firefox 109","4EB200670C035D4F","3B222E566711E992300DC0B15AB9473DAFDEF8C84D0CEF7D3317B4C1821D1436","E11C7F6B3B396261B347D5BD64B823BD0363D1A40C3F0D471A988143ACFC1CF3","2006.10.25","2036.10.25","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1794507","https://bugzilla.mozilla.org/show_bug.cgi?id=343756","NSS 3.11.9","Firefox 2","https://www.swisssign.com/",""
+"SwissSign AG","SwissSign AG","","SwissSign Silver CA - G2","3.108","136","4F1BD42F54BB2F4B","BE6C4DA2BBB9BA59B6F3939768374246C3C005993FA98F020D1DEDBED48A81D5","0E9EF07B096E0E474D06339130CC51C51356BFBF882AE684C43AB5CAAE9371B1","2006.10.25","2036.10.25","RSA 4096 bits","SHA1WithRSA","","","1915902","https://bugzilla.mozilla.org/show_bug.cgi?id=343756","NSS 3.11.9","Firefox 2","https://www.swisssign.com/",""
+"Telia Company","TeliaSonera","","TeliaSonera Root CA v1","3.123","151","0095BE16A0F72E46F17B398272FA8BCD96","DD6936FE21F8F077C123A1A521C12224F72255B73E03A7260693E8A24B0FA389","2102FDA7BB10BDD1CCA494A2BE66E32E15572CC73730736E82421FD39C9E26F5","2007.10.18","2032.10.18","RSA 4096 bits","SHA1WithRSA","","","2020151","https://bugzilla.mozilla.org/show_bug.cgi?id=539924","NSS 3.16","Firefox 29","https://www.teliacompany.com/","ACME endpoint: https://acme.trust.telia.com/directory"
+"TrustCor Systems","TrustCor Systems S. de R.L.","TrustCor Certificate Authority","TrustCor ECA-1","NSS 3.94","Firefox 121","0084822C5F1C62D040","5A885DB19C01D912C5759388938CAFBBDF031AB2D48E91EE15589B42971D039C","76C969C4BA3E3C6D056EB708CB6CCF1A1DB9AC3D437309B747B5297BABC31636","2016.02.04","2029.12.31","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1851049","https://bugzilla.mozilla.org/show_bug.cgi?id=1231853","NSS 3.34","Firefox 58","http://www.trustcorsystems.com","PAG - Princeton Audit Group was removed from https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services/licensed-webtrust-practitioners-international on December 6, 2022."
+"TrustCor Systems","TrustCor Systems S. de R.L.","TrustCor Certificate Authority","TrustCor RootCert CA-1","NSS 3.94","Firefox 121","00DA9BEC71F303B019","D40E9C86CD8FE468C1776959F49EA774FA548684B6C406F3909261F4DCE2575C","EB38B702A2D8DD36CCC99E8A513384F9C4C104E2AECCE771757E1038B02476CE","2016.02.04","2029.12.31","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1851049","https://bugzilla.mozilla.org/show_bug.cgi?id=1231853","NSS 3.34","Firefox 58","http://www.trustcorsystems.com","PAG - Princeton Audit Group was removed from https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services/licensed-webtrust-practitioners-international on December 6, 2022."
+"TrustCor Systems","TrustCor Systems S. de R.L.","TrustCor Certificate Authority","TrustCor RootCert CA-2","NSS 3.94","Firefox 121","25A1DFCA33CB5902","0753E940378C1BD5E3836E395DAEA5CB839E5046F1BD0EAE1951CF10FEC7C965","93E4635F1277A2CCAB309F141517C773AF4355FCF2FDE8BCF4501943CC005E59","2016.02.04","2034.12.31","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1851049","https://bugzilla.mozilla.org/show_bug.cgi?id=1231853","NSS 3.34","Firefox 58","http://www.trustcorsystems.com","PAG - Princeton Audit Group was removed from https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services/licensed-webtrust-practitioners-international on December 6, 2022."
+"WoSign CA Limited","WoSign CA Limited","","CA WoSign ECC Root","NSS 3.34","Firefox 58","684A5870806BF08F02FAF6DEE8B09090","8B45DA1C06F791EB0CABF26BE588F5FB23165C2E614BF885562D0DCE50B29B02","C28B8431BD553FB8DC490C24F6519A903D6CC35D3A2D8AF16A41D0A83A9F67B6","2014.11.08","2044.11.08","EC secp384r1","ecdsaWithSHA384","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1387260","https://bugzilla.mozilla.org/show_bug.cgi?id=1156175","NSS 3.21","Firefox 44","http://www.wosign.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to WoSign CA root certificates are not trusted in Mozilla products, beginning with Firefox 51. 
+WoSign Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824"
+"WoSign CA Limited","WoSign CA Limited","","CA 沃通根证书","NSS 3.34","Firefox 58","50706BCDD813FC1B4E3B3372D211488D","D6F034BD94AA233F0297ECA4245B283973E447AA590F310C77F48FDF83112254","8C55D9AA7525B97DC836B5BDE6B2B7B20844C9B4DC3329C7D4E344737B904846","2009.08.08","2039.08.08","RSA 4096 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1387260","https://bugzilla.mozilla.org/show_bug.cgi?id=851435","NSS 3.16.3","Firefox 32","http://www.wosign.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to WoSign CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+WoSign Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824"
+"WoSign CA Limited","WoSign CA Limited","","Certification Authority of WoSign","NSS 3.34","Firefox 58","5E68D61171946350560068F33EC9C591","4B22D5A6AEC99F3CDB79AA5EC06838479CD5ECBA7164F7F22DC1D65F63D85708","7AD0E4B0A5CAC28B664041F0AA9971043E8AEE198E18DCD98F70CBF31D6C4600","2009.08.08","2039.08.08","RSA 4096 bits","SHA1WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1387260","https://bugzilla.mozilla.org/show_bug.cgi?id=851435","NSS 3.16.3","Firefox 32","http://www.wosign.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to WoSign CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+WoSign Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824"
+"WoSign CA Limited","WoSign CA Limited","","Certification Authority of WoSign G2","NSS 3.34","Firefox 58","6B25DA8A889D7CBC0F05B3B17A614544","D487A56F83B07482E85E963394C1ECC2C9E51D0903EE946B02C301581ED99E16","C712362BB421FC4AC06A25541881BBAB0F40C900916D69C5ABE8214451875CA5","2014.11.08","2044.11.08","RSA 2048 bits","SHA256WithRSA","","","https://bugzilla.mozilla.org/show_bug.cgi?id=1387260","https://bugzilla.mozilla.org/show_bug.cgi?id=1156175","NSS 3.21","Firefox 44","http://www.wosign.com/","https://bugzilla.mozilla.org/show_bug.cgi?id=1309707
+Certs issued after October 21, 2016 that chain up to WoSign CA root certificates are not trusted in Mozilla products, beginning with Firefox 51.
+WoSign Action Items: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824"
@@ -0,0 +1,28 @@
+[jihad-bs] inject url https://revoked.grc.com/
+[jihad-bs] dialog alert suppressed — the certificate error on revoked.grc.com is reported by the SSL confirm instead
+[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html
+[jihad-bs] loaderr failed=1 code=0x805a1ff5 certErr=1 chost=revoked.grc.com ccode=0x805a1ff5
+[jihad-bs] dialog ssl-confirm -> card (pipe /var/palm/jihad/enyo/dialog-1.fifo) host=revoked.grc.com status=0x805a1ff5 flags=1(untrusted=0 selfSigned=0 mismatch=0 badTime=1 expired=1) -> ordinal 0 cert=/var/palm/jihad/enyo/certs/jihad-cert-
+[jihad-bs] dialog ssl-confirm: nobody opened the reply pipe in 4011 ms — no card is answering, taking the default
+[jihad-bs] dialog ssl-confirm: no answer from the card — taking the default
+[jihad-bs] inject url https://revoked-rsa-dv.ssl.com/
+[jihad-bs] dialog alert -> card (pipe /var/palm/jihad/enyo/dialog-2.fifo)
+[jihad-bs] dialog alert: nobody opened the reply pipe in 4006 ms — no card is answering, taking the default
+[jihad-bs] dialog alert: no answer from the card — taking the default
+[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html
+[jihad-bs] loaderr failed=1 code=0x805a1ff4 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://revoked-ecc-dv.ssl.com/
+[jihad-bs] dialog alert -> card (pipe /var/palm/jihad/enyo/dialog-3.fifo)
+[jihad-bs] dialog alert: nobody opened the reply pipe in 4005 ms — no card is answering, taking the default
+[jihad-bs] dialog alert: no answer from the card — taking the default
+[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html
+[jihad-bs] loaderr failed=1 code=0x805a1ff4 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://digicert-tls-rsa4096-root-g5-revoked.chain-demos.digicert.com/
+[jihad-bs] dialog alert -> card (pipe /var/palm/jihad/enyo/dialog-4.fifo)
+[jihad-bs] dialog alert: nobody opened the reply pipe in 4005 ms — no card is answering, taking the default
+[jihad-bs] dialog alert: no answer from the card — taking the default
+[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html
+[jihad-bs] loaderr failed=1 code=0x805a1ff4 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://revoked.badssl.com/
+[jihad-bs] load done uri=https://revoked.badssl.com/
+[jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0
@@ -0,0 +1,46 @@
+[jihad-bs] inject url https://tls-v1-0.badssl.com:1010/
+[jihad-bs] dialog alert -> card (pipe /var/palm/jihad/enyo/dialog-1.fifo)
+[jihad-bs] dialog alert: nobody opened the reply pipe in 4007 ms — no card is answering, taking the default
+[jihad-bs] dialog alert: no answer from the card — taking the default
+[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html
+[jihad-bs] loaderr failed=1 code=0x805a2ff7 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://tls-v1-2.badssl.com:1012/
+[jihad-bs] load done uri=https://tls-v1-2.badssl.com:1012/
+[jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://sha256.badssl.com/
+[jihad-bs] load done uri=https://sha256.badssl.com/
+[jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://expired.badssl.com/
+[jihad-bs] dialog alert suppressed — the certificate error on expired.badssl.com is reported by the SSL confirm instead
+[jihad-bs] load done uri=https://sha256.badssl.com/
+[jihad-bs] loaderr failed=1 code=0x805a1ff5 certErr=1 chost=expired.badssl.com ccode=0x805a1ff5
+[jihad-bs] dialog ssl-confirm -> card (pipe /var/palm/jihad/enyo/dialog-2.fifo) host=expired.badssl.com status=0x805a1ff5 flags=1(untrusted=0 selfSigned=0 mismatch=0 badTime=1 expired=1) -> ordinal 0 cert=/var/palm/jihad/enyo/certs/jihad-ce
+[jihad-bs] dialog ssl-confirm: nobody opened the reply pipe in 4006 ms — no card is answering, taking the default
+[jihad-bs] dialog ssl-confirm: no answer from the card — taking the default
+[jihad-bs] inject url https://wrong.host.badssl.com/
+[jihad-bs] dialog alert suppressed — the certificate error on wrong.host.badssl.com is reported by the SSL confirm instead
+[jihad-bs] load done uri=https://sha256.badssl.com/
+[jihad-bs] loaderr failed=1 code=0x805a2ff4 certErr=1 chost=wrong.host.badssl.com ccode=0x805a2ff4
+[jihad-bs] dialog ssl-confirm -> card (pipe /var/palm/jihad/enyo/dialog-3.fifo) host=wrong.host.badssl.com status=0x805a2ff4 flags=1(untrusted=0 selfSigned=0 mismatch=1 badTime=0 expired=0) -> ordinal 50 cert=/var/palm/jihad/enyo/certs/jiha
+[jihad-bs] dialog ssl-confirm: nobody opened the reply pipe in 4007 ms — no card is answering, taking the default
+[jihad-bs] dialog ssl-confirm: no answer from the card — taking the default
+[jihad-bs] inject url https://self-signed.badssl.com/
+[jihad-bs] dialog alert suppressed — the certificate error on self-signed.badssl.com is reported by the SSL confirm instead
+[jihad-bs] load done uri=https://sha256.badssl.com/
+[jihad-bs] loaderr failed=1 code=0x805a1ff3 certErr=1 chost=self-signed.badssl.com ccode=0x805a1ff3
+[jihad-bs] dialog ssl-confirm -> card (pipe /var/palm/jihad/enyo/dialog-4.fifo) host=self-signed.badssl.com status=0x805a1ff3 flags=1(untrusted=1 selfSigned=1 mismatch=0 badTime=0 expired=0) -> ordinal 18 cert=/var/palm/jihad/enyo/certs/jih
+[jihad-bs] dialog ssl-confirm: nobody opened the reply pipe in 4028 ms — no card is answering, taking the default
+[jihad-bs] dialog ssl-confirm: no answer from the card — taking the default
+[jihad-bs] inject url https://untrusted-root.badssl.com/
+[jihad-bs] dialog alert suppressed — the certificate error on untrusted-root.badssl.com is reported by the SSL confirm instead
+[jihad-bs] load done uri=https://sha256.badssl.com/
+[jihad-bs] loaderr failed=1 code=0x805a1ff3 certErr=1 chost=untrusted-root.badssl.com ccode=0x805a1ff3
+[jihad-bs] dialog ssl-confirm -> card (pipe /var/palm/jihad/enyo/dialog-5.fifo) host=untrusted-root.badssl.com status=0x805a1ff3 flags=1(untrusted=1 selfSigned=0 mismatch=0 badTime=0 expired=0) -> ordinal 20 cert=/var/palm/jihad/enyo/certs/
+[jihad-bs] dialog ssl-confirm: nobody opened the reply pipe in 4030 ms — no card is answering, taking the default
+[jihad-bs] dialog ssl-confirm: no answer from the card — taking the default
+[jihad-bs] inject url https://revoked.badssl.com/
+[jihad-bs] load done uri=https://revoked.badssl.com/
+[jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0
+[jihad-bs] inject url https://en.wikipedia.org/wiki/HP_TouchPad
+[jihad-bs] load done uri=https://en.wikipedia.org/wiki/HP_TouchPad
+[jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0
@@ -0,0 +1,9 @@
+== exports: [jihad-bs] engine: optional export jihad_layout_set_displayport is MISSING from libxul (its fallback is in use)|[jihad-bs] engine: 28 of 29 optional jihad_* exports present|
+== roots/tls: [jihad-bs] js-console (no source):0:0 certs: built-in roots: 169 certificates, 118 trusted for sites, 0 on Mozilla's removed report|
+== cookie: [jihad-bs] inject cookie set ok=1|[jihad-bs] inject cookie count=88|
+== about:settings -> [jihad-bs] js-console (no source):0:0 compat: en.wikipedia.org: CSSStyleSheet.replace, reportError, Intl.ListFormat, Element.checkVisibility, AbortSignal.any, URLSearchParams.size, Array.fromAsync, inert, popover, Blob.text/arrayBuffer, Response.json, Promise.try, Set methods, iterator helpers, Read
+== about:personas -> [jihad-bs] js-console (no source):0:0 compat: en.wikipedia.org: CSSStyleSheet.replace, reportError, Intl.ListFormat, Element.checkVisibility, AbortSignal.any, URLSearchParams.size, Array.fromAsync, inert, popover, Blob.text/arrayBuffer, Response.json, Promise.try, Set methods, iterator helpers, Read
+== about:addons -> [jihad-bs] js-console (no source):0:0 compat: en.wikipedia.org: CSSStyleSheet.replace, reportError, Intl.ListFormat, Element.checkVisibility, AbortSignal.any, URLSearchParams.size, Array.fromAsync, inert, popover, Blob.text/arrayBuffer, Response.json, Promise.try, Set methods, iterator helpers, Read
+== svg -> [jihad-bs] loaderr failed=0 code=0x0 certErr=0 chost= ccode=0x0|[jihad-bs] late load done uri=https://en.wikipedia.org/wiki/HP_TouchPad|
+== select -> [jihad-bs] inject url http://192.168.1.245:8077/jihad-long-static.html|[jihad-bs] load done uri=http://192.168.1.245:8077/jihad-long-static.html|[jihad-bs] titleAndUrl title=[jihad-long-static] uri=ht
+== faults: 0, js errors: 0, sqlite: 0
@@ -0,0 +1,64 @@
+The engine on UXP RB_20261027 (T-552..T-554, 2026-11-03)
+=========================================================
+The owner's choice of 2026-11-02 (the update now; patch 0060 dropped; special attention to the certificate/HTTPS
+changes). The range and each commit's disposition: docs/ENGINE-SOURCE.md, "The move to RB_20261027".
+
+Host (T-552, T-553): update-engine.sh RB_20261027 — the 73 patches applied on the tag in a worktree, 0060 "already
+applied" (byte-identical certdata) and dropped by itself, one overlap listed (certdata.txt); check-engine-api.py 0 FAIL
+0 WARN; --finish: the branch jihad/uxp-RB_20261027 at 52ad9ab66e in third_party/uxp, the queue rewritten (72, renumbered
+from 0060), every pin (UXP/6b18be9 in the UA and the three start pages), patch-queue.sh --check ok. JIHAD_APP_BUILD_ID
+20261103000000. audit-roots.py against the fetched release certdata and the CCADB report: identical set and trust
+(169/118), none removed, RESULT OK (docs/rounds/certs-2026-11-03/audit.txt).
+
+Desktop (T-554): the full desktop build (build/desktop/out, podman, 50 min) clean. The test harness had rotted since
+T-515/T-517 (GDK in EngineHost, the stall sampler in GoannaRenderPage, JihadFrameWindow.h in BrowserPageGoanna, the
+Luna service in the daemon): embed-smoke, embed-load, find, headless-daemon and adapter-roundtrip could not compile or
+link; fixed in build/desktop/build-*.sh (and embed-smoke runs under Xvfb like the rest). Then, of 18:
+  PASS (14): embed-smoke, embed-load (RENDER PASS), cookie (persistence), tls, history, nav, media 18/18, personas 7/7,
+             prefsui 38/38, xpi-mismatch 8/8, scroll, find, headless-daemon, adapter-roundtrip (round trip, overscan,
+             scroll-overscan)
+  FAIL (4):  zoom, input, dialog, settings2 (its popup half; prefs ok) — the desktop GTK path's pixel read-back after a
+             script's change: the alert text is captured and the click is delivered, the frame read back does not
+             change ("read a black window before any click — the desktop harness, not the device path; not chased",
+             PICKUP 2026-10-14); the device checklist covers taps, zoom and dialogs.
+  The jar: flag change: the daemon-level tests bootstrap the bundled XPI through a jar:file: URL as before.
+
+ARM: the full engine build at -j8 beside the desktop build was killed by earlyoom (cc1plus, memory
+one-engine-build-at-a-time); resumed alone at -j4 (build-goanna-arm.sh build 4).
+
+ARM and the device (T-554, 10:00-10:15): the daemon built against the new dist, make-device-bundle.sh, the three
+.ipks (build-variant-ipk.sh), a FULL push per variant (push-variant.sh: the Enyo payload 44991 KiB,
+md5 ab05250c; each md5-verified, each job restarted). default-check ×3: the GPU path with the express lane, faults 0,
+GPU off 0, express off 0 (enyo painted 172, express 7, zooms 5; mochi 210/14/5; mojo 164/10/4); the screenshot
+looked at (desktop Wikipedia after the pinch). tools/device/engine-checks.sh (engine-checks.txt, the pictures
+ec-*.jpg looked at):
+- the daemon's start: "28 of 29 optional jihad_* exports present" — jihad_layout_set_displayport is the v1 export its
+  v2 replaced, missing before the update too (the 2026-10-26 and the 0073 logs say the same line);
+- roots: 169 certificates, 118 trusted for sites, 0 on Mozilla's removed report;
+- the cookie store through SQLite 3.54.1: a cookie set ok, 88 counted; no sqlite error in the log;
+- Jihad's own pages under the jar: flag change: about:settings, about:personas (the list of 13 Personas) and
+  about:addons (the add-on site pane) rendered, 0 JavaScript errors;
+- jihad-svg-filter.html (feTile, the shadow, greyscale, the 1x1 tile over a 4000x4000 region): every box painted;
+- selection (the layout frame-table fix): a long press on the long page selects a word and raises the context menu
+  (Copy, Select All, ...);
+- faults 0.
+
+The certificate kit's checks on the new engine (tools/device/cert-checks.sh, cert-checks.txt; the owner's "special
+attention"): the hand daemon with JIHAD_DIALOG_MS=4000 (an unanswered dialog takes its default after 4 s); the log
+read whole after the daemon exits (its stdout is buffered when redirected, its stderr not — a per-URL tail mixed
+old and new lines, two runs lost to it). Against the 2026-10-25 record:
+- tls-v1-0.badssl.com:1010 -> the engine's alert, loaderr failed=1 code=0x805a2ff7 certErr=0: refused (the TLS 1.2 floor)
+- tls-v1-2.badssl.com:1012, sha256.badssl.com, en.wikipedia.org -> loaded, certErr=0
+- expired -> alert suppressed, ssl-confirm (badTime=1 expired=1), loaderr failed=1 code=0x805a1ff5 certErr=1
+- wrong.host -> ssl-confirm (mismatch=1), 0x805a2ff4 certErr=1
+- self-signed -> ssl-confirm (untrusted=1 selfSigned=1), 0x805a1ff3 certErr=1
+- untrusted-root -> ssl-confirm (untrusted=1), 0x805a1ff3 certErr=1
+- revoked.badssl.com -> loaded clean (the 2026-10-25 record has no result for it; the kit's revocation evidence is
+  revoked.grc.com and ssl.com's revoked hosts, OCSP: run below)
+- the revoked hosts (cert-checks-revoked.txt), as on 2026-10-25: revoked.grc.com -> the ssl-confirm (its certificate
+  is expired too, 0x805a1ff5); revoked-rsa-dv.ssl.com, revoked-ecc-dv.ssl.com and DigiCert's revoked chain demo ->
+  the engine's alert and loaderr failed=1 code=0x805a1ff4, no Trust buttons (OCSP revocation enforced);
+  revoked.badssl.com -> loaded clean, as then (CRL-only revocation is invisible to UXP: no CRL fetch, no CRLite —
+  the certificate kit's R7 records it).
+Verdict: no certificate or TLS behaviour changed with the base; the roots are the base's and identical to the ones
+shipped on 2026-10-25.
@@ -63,11 +63,11 @@
 // rescan on every build and make the daemon binary non-reproducible. BUMP IT
 // when shipping a build whose chrome/components changed in a way that must
 // invalidate those caches.
-#define JIHAD_APP_BUILD_ID "20261012000000"   // the engine moved to UXP RB_20261006
+#define JIHAD_APP_BUILD_ID "20261103000000"   // the engine moved to UXP RB_20261027

 #define JIHAD_USER_AGENT \
  "Mozilla/5.0 (Linux armv7l; webOS/3.0.5; hpwOS/3.0.5; TouchPad) " \
-  "Goanna/6.9 UXP/5f290d1 Firefox/52.9 ECMAScript/2024 " \
+  "Goanna/6.9 UXP/6b18be9 Firefox/52.9 ECMAScript/2024 " \
  JIHAD_APP_NAME "/" JIHAD_APP_VERSION

 #endif // JIHAD_USER_AGENT_H
@@ -0,0 +1,38 @@
+<!doctype html>
+<!-- jihad-svg-filter.html — SVG filters on the software filter path (gfx/2d/FilterNodeSoftware.cpp): feTile
+     (whose rect arithmetic UXP RB_20261027 guards against overflow, bae7a6ec8f), feGaussianBlur, feOffset,
+     feColorMatrix, and a feTile whose tile rect is tiny and whose filter region is large (the overflow case). A
+     page that paints every box and raises no fault passes; the daemon's log says the rest. -->
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width">
+<title>jihad-svg-filter</title>
+<style> body { margin: 0; padding: 16px; font: 20px/1.4 sans-serif; background: #f8f6f0; } svg { display: block; margin: 12px 0; background: #fff; } </style>
+</head><body>
+<h1>SVG filters</h1>
+<p>1. feTile: a 40x40 tile of a blue box, repeated over 300x120</p>
+<svg width="320" height="140">
+  <defs><filter id="tile" x="0" y="0" width="300" height="120" filterUnits="userSpaceOnUse">
+    <feFlood x="0" y="0" width="40" height="40" flood-color="#2b4c7e" result="f"/>
+    <feOffset in="f" dx="4" dy="4" x="0" y="0" width="40" height="40" result="o"/>
+    <feTile in="o"/>
+  </filter></defs>
+  <rect x="10" y="10" width="300" height="120" fill="#ffe9a8" filter="url(#tile)"/>
+</svg>
+<p>2. feGaussianBlur + feOffset (a drop shadow) and feColorMatrix (greyscale)</p>
+<svg width="320" height="140">
+  <defs>
+    <filter id="shadow"><feGaussianBlur in="SourceAlpha" stdDeviation="4"/><feOffset dx="6" dy="6" result="s"/><feMerge><feMergeNode in="s"/><feMergeNode in="SourceGraphic"/></feMerge></filter>
+    <filter id="grey"><feColorMatrix type="saturate" values="0"/></filter>
+  </defs>
+  <circle cx="70" cy="70" r="50" fill="#c8e6c9" filter="url(#shadow)"/>
+  <rect x="160" y="20" width="120" height="100" fill="#e53935" filter="url(#grey)"/>
+</svg>
+<p>3. feTile, the overflow case: a 1x1 tile over a 4000x4000 filter region on a 300x100 box</p>
+<svg width="320" height="120">
+  <defs><filter id="tilebig" x="-2000" y="-2000" width="4000" height="4000" filterUnits="userSpaceOnUse">
+    <feFlood x="0" y="0" width="1" height="1" flood-color="#2b4c7e" result="f"/>
+    <feTile in="f"/>
+  </filter></defs>
+  <rect x="10" y="10" width="300" height="100" fill="#ffe9a8" filter="url(#tilebig)"/>
+</svg>
+<p>4. the end: every box above painted, no fault</p>
+</body></html>
@@ -0,0 +1,38 @@
+#!/bin/bash
+# Copyright 2026 NotAlexNoyle. Apache-2.0.
+#
+# cert-checks.sh [out.txt]: the certificate kit's device checks on the Enyo variant (cavekit-certificate-trust.md
+# R4/R6/R7; the 2026-10-25 round did them by hand). The daemon is started by hand with the inject channel
+# (tools/device/t502/gpu-spike-start.sh: the shipped job has no JIHAD_INJECT), each URL is sent to the card
+# through it, and the daemon log's load, loaderr, dialog and padlock lines since the mark are the answer; the
+# Enyo job is put back after (t502/enyo-restore-job.sh). A page that raises a dialog waits the daemon's 60 s
+# default when nothing answers it, so the list is short. Expected: tls-v1-0 refused (the TLS 1.2 floor),
+# tls-v1-2, sha256 and Wikipedia loaded with certErr=0, expired / wrong.host / self-signed / untrusted-root
+# failed with a certificate error (certErr=1 or an ssl-confirm), revoked an alert, never a silent load.
+set -u
+R=/home/notalexnoyle/eclipse-workspace/Jihad/Jihad-Browser; cd $R; . build/webos-oe/host-path.sh
+OUT=${1:-/dev/stdout}
+# JIHAD_DIALOG_MS=4000: an alert or ssl-confirm nobody answers takes its default after 4 s, not 60 (the daemon blocks on it)
+build/webos-oe/dev-sh.sh -t 90 tools/device/t502/gpu-spike-start.sh "http://192.168.1.245:8077/jihad-long-static.html" "JIHAD_INJECT=1 JIHAD_DIALOG_MS=4000" 2>&1 | grep 'screenshot at\|FATAL' | tail -n 1
+URLS=${URLS:-"https://tls-v1-0.badssl.com:1010/ https://tls-v1-2.badssl.com:1012/ https://sha256.badssl.com/ https://expired.badssl.com/ https://wrong.host.badssl.com/ https://self-signed.badssl.com/ https://untrusted-root.badssl.com/ https://revoked.badssl.com/ https://en.wikipedia.org/wiki/HP_TouchPad"}
+S=/tmp/claude-cert-checks.sh
+# The daemon's inject and load lines are stdout (buffered when redirected to the log), its dialog lines stderr
+# (unbuffered): a per-URL tail of the log mixes old and new lines. So: each URL sent, a fixed wait (alerts take
+# their default after JIHAD_DIALOG_MS), and the whole log read once the daemon has exited (its buffers flushed).
+cat > $S <<'EOS'
+STATE=/var/palm/jihad/enyo
+LOG=$STATE/daemon-gpu.log
+sleep 8
+wc -c < $LOG > /tmp/cert-mark
+for u in URLS; do
+  umask 077; echo "url $u" > $STATE/inject.cmd
+  sleep 14
+done
+cat /tmp/cert-mark
+EOS
+sed -i "s|URLS|$URLS|" $S
+MARK=$(build/webos-oe/dev-sh.sh -t 300 $S | tail -n 1)
+rm -f $S
+build/webos-oe/dev-sh.sh -t 90 tools/device/t502/enyo-restore-job.sh 2>&1 | grep 'running\|killing' | sed 's/^/restore: /'
+# the hand daemon's log, from the mark: the inject, load, loaderr, dialog and ssl-confirm lines in the order written
+novacom get file:///var/palm/jihad/enyo/daemon-gpu.log 2>/dev/null | tail -c +$(( ${MARK:-0} + 1 )) | grep -a 'inject url\|load done\|loaderr\|dialog \|ssl-confirm\|certs:' | cut -c1-240 | tee "$OUT"
@@ -0,0 +1,53 @@
+#!/bin/bash
+# Copyright 2026 NotAlexNoyle. Apache-2.0.
+#
+# engine-checks.sh <round dir>: the areas an engine update touches, on the Enyo variant by a hand-started daemon
+# with the inject channel (cavekit-engine-release-2026-10.md R4): the daemon's engine-exports line; Jihad's own
+# pages through jar:/resource: (about:settings, about:personas, about:addons) and an SVG filter page
+# (render/goanna/test/jihad-svg-filter.html, served by the test server), each with a screenshot to look at; a
+# long press on the long page (selection); the cookie store across the update (a cookie set, counted again
+# after a daemon restart). The Enyo job is put back after. Then run tools/device/cert-checks.sh.
+set -u
+R=/home/notalexnoyle/eclipse-workspace/Jihad/Jihad-Browser; cd $R; . build/webos-oe/host-path.sh
+D=${1:?round dir}; mkdir -p "$D"
+FINGER=${FINGER:-}   # a host path of the cross-built finger tool to push (tools/device/finger/README.md)
+[ -n "$FINGER" ] && [ -f "$FINGER" ] && novacom put file:///tmp/finger < "$FINGER"
+build/webos-oe/dev-sh.sh -t 90 tools/device/t502/gpu-spike-start.sh "https://en.wikipedia.org/wiki/HP_TouchPad" "JIHAD_INJECT=1" 2>&1 | grep 'screenshot at\|FATAL' | tail -n 1
+S=/tmp/claude-engine-checks.sh
+cat > $S <<'EOS'
+STATE=/var/palm/jihad/enyo
+LOG=$STATE/daemon-gpu.log
+[ -f /tmp/finger ] && chmod +x /tmp/finger
+sleep 6
+echo "== exports: $(grep -a 'exports\|export' $LOG | grep -a -i 'engine\|jihad_' | head -n 2 | tr '\n' '|' | cut -c1-300)"
+echo "== roots/tls: $(grep -a 'roots:\|TLS\|tls' $LOG | head -n 2 | tr '\n' '|' | cut -c1-200)"
+shot() { sleep 7; luna-send -n 1 palm://com.palm.systemmanager/takeScreenShot '{"file":"/tmp/ec-'$1'.png"}' >/dev/null 2>&1; }
+inj() { umask 077; echo "$1" > $STATE/inject.cmd; }
+mark=$(wc -c < $LOG)
+inj "cookie set en.wikipedia.org jihadupd rb27"; sleep 2
+inj "cookie count"; sleep 2
+echo "== cookie: $(tail -c +$((mark+1)) $LOG | grep -a 'inject cookie' | tr '\n' '|')"
+for p in about:settings about:personas about:addons; do
+  mark=$(wc -c < $LOG); inj "url $p"; shot ${p#about:}
+  echo "== $p -> $(tail -c +$((mark+1)) $LOG | grep -a 'load done\|loaderr\|js-console.*rror' | head -n 3 | tr '\n' '|' | cut -c1-300)"
+done
+mark=$(wc -c < $LOG); inj "url http://192.168.1.245:8077/jihad-svg-filter.html"; shot svg
+echo "== svg -> $(tail -c +$((mark+1)) $LOG | grep -a 'load done\|loaderr\|FATAL' | head -n 2 | tr '\n' '|' | cut -c1-200)"
+mark=$(wc -c < $LOG); inj "url http://192.168.1.245:8077/jihad-long-static.html"; sleep 8
+[ -x /tmp/finger ] && /tmp/finger hold 300 400 1500; sleep 3
+luna-send -n 1 palm://com.palm.systemmanager/takeScreenShot '{"file":"/tmp/ec-select.png"}' >/dev/null 2>&1
+echo "== select -> $(tail -c +$((mark+1)) $LOG | grep -a 'selection\|long\|FATAL' | head -n 3 | tr '\n' '|' | cut -c1-200)"
+echo "== faults: $(grep -a -c 'FATAL SIGNAL' $LOG), js errors: $(grep -a -c 'js-console.*JavaScript Error' $LOG), sqlite: $(grep -a -i -c 'sqlite.*error\|corrupt' $LOG)"
+EOS
+build/webos-oe/dev-sh.sh -t 300 $S | tee "$D/engine-checks.txt"
+rm -f $S
+for n in settings personas addons svg select; do
+  novacom get file:///tmp/ec-$n.png > "$D/ec-$n.png" 2>/dev/null
+  python3 -c "
+from PIL import Image
+Image.open('$D/ec-$n.png').rotate(-90, expand=True).convert('RGB').resize((576,768)).save('$D/ec-$n.jpg', quality=85)" 2>/dev/null && rm -f "$D/ec-$n.png" && echo "screenshot $D/ec-$n.jpg"
+done
+novacom run file:///bin/rm -- -f /tmp/ec-settings.png /tmp/ec-personas.png /tmp/ec-addons.png /tmp/ec-svg.png /tmp/ec-select.png
+# the cookie across a restart: the job's daemon, then the count under the inject channel again is the next round's;
+# here the restart is the job's (enyo-restore-job.sh) and the count is read from the job's log at the next start
+build/webos-oe/dev-sh.sh -t 90 tools/device/t502/enyo-restore-job.sh 2>&1 | grep 'running\|killing' | sed 's/^/restore: /'
@@ -0,0 +1,15 @@
+#!/bin/sh
+# Copyright 2026 NotAlexNoyle. Apache-2.0.
+# enyo-restore-job.sh (run with build/webos-oe/dev-sh.sh): the Enyo variant back on its upstart job after a
+# hand-started (spike) daemon, the round dumps removed, the three jobs reported.
+# the Enyo variant back on its upstart job after a hand-started (spike) daemon
+HL=/media/cryptofs/apps/usr/palm/applications/net.riverstonerelay.jihad-browser/deviceroot/hl
+stop jihad >/dev/null 2>&1; sleep 2
+for p in /proc/[0-9]*; do c=$(tr '\0' ' ' 2>/dev/null < $p/cmdline); case "$c" in *jihad-browserserver*"$HL"*) echo "killing hand daemon ${p#/proc/}"; kill ${p#/proc/} 2>/dev/null;; esac; done
+sleep 3
+for p in /proc/[0-9]*; do c=$(tr '\0' ' ' 2>/dev/null < $p/cmdline); case "$c" in *jihad-browserserver*"$HL"*) kill -9 ${p#/proc/} 2>/dev/null; echo "SIGKILL ${p#/proc/}";; esac; done
+rm -f /tmp/frame.raw /tmp/frames.raw /tmp/frame.raw-* /tmp/st-pan.png /tmp/vs-*.raw /tmp/vw-*.raw
+start jihad; sleep 10
+status jihad; status jihad-mochi; status jihad-mojo
+ls /var/palm/jihad/enyo/ | grep -v 'log\|prefs' | head
+df /var | tail -1