NSS certutil doesn't properly batch sqlite transactions when adding a cert

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============8669100346079060343==
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature";
 boundary="jrfWylYs2OP6sr9VIpNJvmYT5ongjiRVM"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--jrfWylYs2OP6sr9VIpNJvmYT5ongjiRVM
From: Jeremy Rand <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: NSS certutil doesn't properly batch sqlite transactions when adding a
 cert
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

I've been doing some experiments with certutil in sqlite mode, and it
appears that when I add a cert, 2 rows are inserted to the sqlite
database.  So far so good.  However, based on looking at the source code
(and some cursory ltrace inspection) it definitely looks like each of
those rows is inserted in its own sqlite transaction, rather than
batching the two inserts into a single transaction.

I strongly suspect that this is the reason why adding a cert in sqlite
mode is so slow.  (I'm seeing latency of around 800ms on a regular
basis, although I'm on Qubes, so any I/O latency caused by NSS will be
exacerbated on my system.)

Am I correct about NSS currently using 2 transactions to add a cert?  Is
there some undocumented trick to fix this, or should I file a Bugzilla
bug?  (I'm seriously on the verge of trying to implement an LD_PRELOAD
proxy between NSS and sqlite in order to filter out the extra
transaction commands, but I definitely hope that level of witchcraft
won't be necessary....)

Cheers,
--=20
-Jeremy Rand
Lead Application Engineer at Namecoin
Mobile email: [email protected]
Mobile OpenPGP: 2158 0643 C13B B40F B0FD 5854 B007 A32D AB44 3D9C
Send non-security-critical things to my Mobile with OpenPGP.
Please don't send me unencrypted messages.
My business email [email protected] is having technical issues at the
moment.


--jrfWylYs2OP6sr9VIpNJvmYT5ongjiRVM
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEVB3fdzAraEcoBtkSs/LRZXhtZXAFAlps1/8ACgkQs/LRZXht
ZXBWWhAAge0HzjmpQbDkgJPr0tNTcIodWHMG5x09PzHhOQwC4+wfAFVC0/7gfURt
WrAcvClj3BLjGd03+8IIfoqsELqrL8ZyQ3m20RSYCeZW3S9m8TG7L3+C9FsOsLOX
l4YptNELDQnCGvqiWPDL22ymX7ZXR2GnfFskcjQM51p+8XGNjNLUYc9XOHGcG7tC
qmMlp6tpPkP6ejWAeM2r2Xn3rabLJIlax6/JBpKdwg7mgKd1U/PEt7HwmxUWWHAb
xKnLdTsG/OtZJY+UzX1s9T0ZVrk2fv6RLtXdyNvO352ot07WHSAPf7L55PqPBGRk
NVpy8W2CdW1xSWkWeU30LUJ9hPCG0Q4VakW1IzXk1sGCWJStfnEC4BB9LXdh2vpm
t+8xlhIxZFOBB7w8jLfn/DiKqEzoBxuOLAIIP97pBtXe4DWBiKvyJA1olmARijLH
H7ARls2bkNXgHTLyC3X4rcjqMCUKPydvNFjP2MMjLZsjyeFjmn1blscCZChClDL0
K7XdPgNu/tzImCLXIqhKbXc2FosluIuvmaPkGtclTLLQUxR+PtaVTv2+VuBu9Sk4
+7J9cLrqP07i/fTlfoSRHdarWQ40x4zjzgZyHl4lZzzdDg6rULRJqbzw1tBufOrr
3cOlLY1WbnFJjVxsXzJ8V2f3JXNlD624ES6PhR2HUBMv+eAq9DE=
=jECF
-----END PGP SIGNATURE-----

--jrfWylYs2OP6sr9VIpNJvmYT5ongjiRVM--

--===============8669100346079060343==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security

--===============8669100346079060343==--