frederik Reporter
	Description • 6 years ago

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36

Steps to reproduce:

I checked firefox about to trigger a firefox update


Actual results:

Firefox updated from version 57 to version 58.
pkcs11 modules that were configured got removed after Firefox restarted as Firefox 58


Expected results:

pkcs11 modules should still be configured.

	frederik Reporter
	Comment 1 • 6 years ago

It is reproducable both with the pkcs11 modules manually added, or with the belgian eid plugin active (which auto configures the pkcs11 modules). (But its webextention version can only do so if the user has done some extra configuration settings in advance (e.g. by installing new version of our middleware)).

I can only reproduce this on Windows 10, not on macOS 10.13.

Is especially painfull for users that have permission to update their Firefox, but not to install a newer version of the package needed to do the extra Firefox plugin configuration (tell the plugin were to find the pkcs11 module).

	BPER_ILEX
	Comment 2 • 6 years ago

Hello,

I also doing some tests on this topic.

Which is the Firefox 57 arch (32 & 64) that you are using ?

Regards.

	frederik Reporter
	Comment 3 • 6 years ago

I'm using 64bit Firefox 57

	Wouter Verhelst :wouter
	Comment 4 • 6 years ago

Could this be related to Firefox changing bitness on upgrade? A 32 bit PKCS#11 middle wouldn't work in a 64 bit one, and I believe that older versions of Firefox were 32-bit only.

That would also explain why the issue doesn't exist on MacOS or Linux...

	Tomislav Jovanovic :zombie
	Comment 5 • 6 years ago

Hmm, that sounds like a good guess, I'm trying to confirm when we did the switch for existing 32bit users.


Frederik:  Is this reproducible on a freshly downloaded firefox 57 with a fresh profile?  If so, can you please leave _detailed_ steps to reproduce, starting with a clean 57 install?

	BPER_ILEX
	Comment 6 • 6 years ago

Hi,

I have tested this update scenario in a Windows VM containing a remaining FF58 user profile even if FF58 was uninstalled.

And I can confirm that the problem arises in this configuration.

In a fresh firefox install (with no remaining FF profile before install) the update 57 -> 58 is OK, ie: the security module is present.

	frederik Reporter
	Comment 7 • 6 years ago

Hello Bertrand,

Thanks for pointing towards the user profiles, I see the same behaviour.

Steps to reproduce:
1)Delete all user profiles
2)uninstall FF58 through add/remove programs in Windows
3)install FF57.0.4 64bit from Firefox Setup 57.0.4.exe
4)add the 64-bit pkcs11 module to FF57
5)now go to about and let FF57 upgrade to FF58
->the pkcs11 module is still there

6)remove the pkcs11 module in FF58
7)uninstall FF58 through add/remove programs in Windows
8)install FF57.0.4 64bit from Firefox Setup 57.0.4.exe
-> the pkcs11 module is there again
9)now go to about and let FF57 upgrade to FF58
->the pkcs11 module is gone again

Originally I did not delete the user profiles, so I circled steps 6 till 9 and saw the pkcs11 module disappearing after the upgrade from FF57 to FF58.

	Tomislav Jovanovic :zombie
	Comment 8 • 6 years ago

> 4)add the 64-bit pkcs11 module to FF57
Can you please give more detailed steps here?  
Which file is installed, and how? (links to existing documentation in english would be enough).

> 5)now go to about and let FF57 upgrade to FF58
> ->the pkcs11 module is still there

The module still working when using a clean profile means something other is responsible for breaking when the firefox upgrades.  Without you tracking down what that thing is, we can't reproduce the problem, and thus unable to help.


> 6)remove the pkcs11 module in FF58
> 7)uninstall FF58 through add/remove programs in Windows
> 8)install FF57.0.4 64bit from Firefox Setup 57.0.4.exe
> -> the pkcs11 module is there again
> 9)now go to about and let FF57 upgrade to FF58
> ->the pkcs11 module is gone again

Using a user profile from a later firefox version (58) with a previous firefox (57) is not a supported configuration, and users are advised against doing that.

	frederik Reporter
	Comment 9 • 6 years ago

> 4)add the 64-bit pkcs11 module to FF57
Can you please give more detailed steps here?  
Which file is installed, and how? (links to existing documentation in english would be enough).
-> https://eid.belgium.be/en/log#7499


The module still working when using a clean profile means something other is responsible for breaking when the firefox upgrades.  Without you tracking down what that thing is, we can't reproduce the problem, and thus unable to help.
-> I believe the answer to that question is that uninstalling firefox 58 does not clear the firefox 58 user profile, resulting in the issue

	Tomislav Jovanovic :zombie
	Comment 10 • 6 years ago

Ok, seems this is only reproducible via unsupported use of newer profile with an older firefox, so I'm closing as invalid.

	Tomislav Jovanovic :zombie
	Comment 11 • 6 years ago

Found the underlying bug 1377940 that made the profile DB incompatible between 57 and 58.