Google Maps Platform Root CA migration [186840968]

Fixed

Process

Status Update

No update yet.

Description

jh...@google.com

created issue #1

Apr 30, 2021 12:49PM

Dear Developers,

As announced on March 15 2021 on the Google Security Blog, GS Root R2, the root CA Google Maps Platform has used since early 2018 will expire on December 15, 2021. Therefore, our services must switch to certificates issued by another certificate authority, GTS Root R1 Cross, and developers should expect that their Google Maps Platform clients will authenticate against this CA in the coming years. To smooth this transition, GTS Root R1 Cross is cross-signed both by Google's own GTS Root R1 and GlobalSign Root CA - R1.

This means that our services will gradually transition to TLS leaf certificates issued by this new CA.

Almost all modern TLS clients and systems are already preconfigured with the GTS Root R1 certificate or should receive it via normal software updates, and GlobalSign Root CA - R1 should even be available on older legacy systems.

However, you should verify your systems at least if both the following points apply:

your services run on non-standard or legacy platforms and/or you maintain your own root certificates store
you did not take action in 2017-2018, during the first phase of Google's root CA migration, or you did not install the full set of certificates from the trusted Google root CA bundle

Tip: To future-proof your application, we recommend you add all certificates from the curated list in trusted Google root CA bundle to your root certificates store, and make a habit of keeping the two in sync.

Important: If your services are unable to connect to Google Maps Platform services because of this Root CA migration, section What to do in a production outage in our newly updated Google Maps Platform Root CA Migration FAQ provides further instructions.

Note: We are aware of some customers having reported difficulties connecting to Google Maps Platform servers under the the googleapis.com domain following an experiment using certificates issued by GTS Root R1 Cross rolling out to a limited number of Google frontend servers. We initiated a rollback of this experiment following these reports, but you should expect the rollout to resume on the week of May 24, 2021.

For further tips and context, please refer to the updated Google Maps Platform Root CA Migration FAQ.

Comments

vi...@google.com <vi...@google.com> May 5, 2021 10:00AM

Reassigned to vi...@google.com.

ma...@google.com <ma...@google.com> #2May 20, 2021 02:41PM

Some things to work out before making the annotations type-use:

Determine guidelines for type nullability in public API
Determine rules for when type nullability can change in public API
Confirm that intellij nullability lint works as expected for type-use nullability annotations
Test what the impact would be on existing arrays (due to ambiguities of type-use annotations on arrays)
Confirm usage of type-use androidx.annotation.NonNull/Nullable in metalava won't break anything for platform

jh...@google.com <jh...@google.com> #3Aug 9, 2021 02:15PM

Plan for making the annotations type-use: https://docs.google.com/document/d/1tNqV9Dgtii6wvulm8emjs0bwgSL3Fwf3F4LFXfVeyTU/edit

Message last modified on Aug 10, 2021 01:31PM

jh...@google.com <jh...@google.com> #4Aug 11, 2021 10:04AM

Tracking sheet for which projects have been migrated.

vi...@google.com <vi...@google.com> #5Aug 17, 2021 03:25PM

Project: platform/frameworks/support
Branch: androidx-main

commit 558f17c6f9e237897fcc87fa556ca4af5c1808c6
Author: Julia McClellan <juliamcclellan@google.com>
Date: Thu Sep 19 14:50:25 2024

Add JSpecify to list of Dackka allowed nullness annotations

Test: Compared the output of `./gradlew docs-tip-of-tree:docs` with the current codebase and aosp/3190072, which switches all nullness annotations to jspecify. Only observed changes were updated nullness annotation links and additional copies of some inherited methods when a parent used a different nullness annotation (similar to

b/280845383

)
Bug: 326456246

Change-Id: I40ede9c84dbae3a1ac7d3d4e98f77a56e119caaa

M buildSrc/private/src/main/kotlin/androidx/build/docs/AndroidXDocsImplPlugin.kt

https://android-review.googlesource.com/3272873

vi...@google.com <vi...@google.com> #6Sep 1, 2021 12:12PM

Marked as fixed.

Project: platform/frameworks/support
Branch: androidx-main

commit c8f5025ba9bf1deb5effbebb7e79683ee7ff9f50
Author: Julia McClellan <juliamcclellan@google.com>
Date: Fri Sep 20 12:31:45 2024

Add JSpecify package-list

Bug: 326456246
Test: checking links in output of `./gradlew docs-tip-of-tree:docs` with aosp/3190072 which switches annotations to jspecify
Change-Id: Ic52ecc37cfb84002ba830dfca6186db2dc5bae67

M buildSrc/private/src/main/kotlin/androidx/build/dackka/DackkaTask.kt
A docs-public/package-lists/jspecify/package-list

https://android-review.googlesource.com/3275171

Issue 186840968