New issue
Advanced search Search tips

Issue 632351 link

Starred by 2 users

Issue metadata

Status: Verified
Owner:
Closed: Jul 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: All
Pri: 3
Type: Bug



Sign in to add a comment

Remove the --certificate-transparency-log command-line flag

Project Member Reported by rsleevi@chromium.org, Jul 28 2016

Issue description

The --certificate-transparency-log flag allows users to specify additional CT logs to consider when evaluating CT policy.

It was largely intended for debugging - either by Googlers when standing up a new Google log, or by third-party log operators when testing their log. However, in practice, that means the total population of users is in the double digits, and the frequency of use is even rarer, since logs don't exactly come around often.

The downside to having the flag is that it forces //net to allow the addition of CT logs from outside of //net's baked in logs, and as a result, complicates CT initialization. It also makes it somewhat trickier to expand the definition of a log, such as adding a DNS suffix for inclusion proof fetching, since we can't be sure what the command-line specified log will support.

Instead, we should just remove this flag entirely. Log operators that want to test Chrome/Chromium with their log should build Chromium locally for testing, the same as other features. This should also allow improving how logs are initialized and what guarantees can be made about logs, as the only source of logs now should be //net.
 
Project Member

Comment 1 by bugdroid1@chromium.org, Jul 28 2016

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/bfb1dee36cd495b0d7c2227fe87678bb4a2fad15

commit bfb1dee36cd495b0d7c2227fe87678bb4a2fad15
Author: eranm <eranm@chromium.org>
Date: Thu Jul 28 17:21:17 2016

Remove --certificate-transparency-log command-line flag

This removes the --certificate-transparency-log command-line flag
from Chrome initialization. It was used to be able to add additional
logs at runtime, but this was only ever intended to be used when
standing up a new log, and if you're standing up a new log, then it's
not unreasonable to expect locally compiling Chromium to test.

If there is significant concern from log operators, we can revisit how to
add logs on demand, but so far, there hasn't been a need.

BUG= 632351 

Review-Url: https://codereview.chromium.org/2184053002
Cr-Commit-Position: refs/heads/master@{#408408}

[modify] https://crrev.com/bfb1dee36cd495b0d7c2227fe87678bb4a2fad15/chrome/browser/io_thread.cc
[modify] https://crrev.com/bfb1dee36cd495b0d7c2227fe87678bb4a2fad15/chrome/common/chrome_switches.cc
[modify] https://crrev.com/bfb1dee36cd495b0d7c2227fe87678bb4a2fad15/chrome/common/chrome_switches.h

Status: Verified (was: Started)

Sign in to add a comment