Root certificate updater is broken

[richardlau]

The GitHub workflow that update the root certificates in Node.js has been failing,
e.g. https://github.com/nodejs/node/actions/runs/16394348697/job/46324526152#step:5:10

Failed to fetch https://hg.mozilla.org/releases/mozilla-release/raw-file/FIREFOX_140_0_4_RELEASE/security/nss/TAG-INFO: 404: Not Found

We use the tag that was there to find the NSS version used and then pull the data from https://github.com/nss-dev/nss (the source of truth), recording the NSS version in our commit message to help reproducibility of the updates.

This appears to be because of changes as Mozilla migrate from Mercurial to GitHub: https://bugzilla.mozilla.org/show_bug.cgi?id=1973571 (which was fixed once but the file has disappeared again).

We may need to see how https://bugzilla.mozilla.org/show_bug.cgi?id=1967607 is resolved.

[richardlau]

This appears to be because of changes as Mozilla migrate from Mercurial to GitHub: https://bugzilla.mozilla.org/show_bug.cgi?id=1973571 (which was fixed once but the file has disappeared again).

Actually the TAG-INFO file is there on the main branch: https://github.com/mozilla-firefox/firefox/blob/main/security/nss/TAG-INFO
It's there in the Firefox 142 tags, e.g. https://github.com/mozilla-firefox/firefox/blob/FIREFOX_142_0b3_RELEASE/security/nss/TAG-INFO, but not in earlier (e.g. Firefox 141) tags so maybe this will fix itself when Firefox 142 is released.

[richardlau]

This appears to be fixed with the Firefox 142 release.
I ran https://github.com/nodejs/node/actions/runs/17141269066/job/48629022091 which has opened #59571.