--- a/browser/confvars.sh
+++ b/browser/confvars.sh
@@ -16,18 +16,25 @@ if test "$OS_ARCH" = "WINNT"; then
             "$MOZ_UPDATE_CHANNEL" = "aurora" -o \
             "$MOZ_UPDATE_CHANNEL" = "beta" -o \
             "$MOZ_UPDATE_CHANNEL" = "release"; then
       if ! test "$MOZ_DEBUG"; then
         MOZ_STUB_INSTALLER=1
       fi
     fi
   fi
+elif test "$OS_ARCH" = "Linux"; then
+  MOZ_VERIFY_MAR_SIGNATURE=1
+elif test "$OS_ARCH" = "Darwin"; then
+  MOZ_VERIFY_MAR_SIGNATURE=1
 fi
 
+# Enable building ./signmar and running libmar signature tests
+MOZ_ENABLE_SIGNMAR=1
+
 MOZ_CHROME_FILE_FORMAT=omni
 MOZ_DISABLE_EXPORT_JS=1
 MOZ_SAFE_BROWSING=1
 MOZ_SERVICES_COMMON=1
 MOZ_SERVICES_CRYPTO=1
 MOZ_SERVICES_HEALTHREPORT=1
 MOZ_SERVICES_METRICS=1
 MOZ_SERVICES_SYNC=1

--- a/configure.in
+++ b/configure.in
@@ -6420,21 +6420,17 @@ dnl Verify MAR signatures
 dnl ========================================================
 
 MOZ_ARG_ENABLE_BOOL(verify-mar,
 [  --enable-verify-mar     Enable verifying MAR signatures],
     MOZ_VERIFY_MAR_SIGNATURE=1,
     MOZ_VERIFY_MAR_SIGNATURE= )
 
 if test -n "$MOZ_VERIFY_MAR_SIGNATURE"; then
-  if test "$OS_ARCH" = "WINNT"; then
-    AC_DEFINE(MOZ_VERIFY_MAR_SIGNATURE)
-  else
-    AC_MSG_ERROR([Can only build with --enable-verify-mar with a Windows target])
-  fi
+  AC_DEFINE(MOZ_VERIFY_MAR_SIGNATURE)
 fi
 
 dnl ========================================================
 dnl Enable building the signmar program.
 dnl This option is much different than the --enable-verify-mar option.
 dnl --enable-verify-mar is for enabling the verification check on MAR
 dnl files in the updater.  The --enable-signmar option is for building
 dnl the signmar program.

--- a/modules/libmar/moz.build
+++ b/modules/libmar/moz.build
@@ -4,18 +4,14 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this
 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
 
 DIRS += ['src']
 
 if CONFIG['MOZ_ENABLE_SIGNMAR']:
     DIRS += ['sign', 'verify']
     TEST_DIRS += ['tests']
-elif CONFIG['OS_ARCH'] == 'WINNT':
-    # On Windows we don't verify with NSS and updater needs to link to it
-    DIRS += ['verify']
-elif CONFIG['OS_ARCH'] == 'Darwin':
-    # On OSX we don't verify with NSS and updater needs to link to it.
+elif CONFIG['MOZ_VERIFY_MAR_SIGNATURE']:
     DIRS += ['verify']
 
 # If we are building ./sign and ./verify then ./tool must come after it
 DIRS += ['tool']
 

--- a/toolkit/mozapps/update/updater/moz.build
+++ b/toolkit/mozapps/update/updater/moz.build
@@ -40,17 +40,22 @@ if CONFIG['OS_ARCH'] == 'WINNT':
         'shell32',
         'shlwapi',
         'crypt32',
         'advapi32',
     ]
 else:
     USE_LIBS += [
         'updatecommon',
+        '/modules/libmar/sign/signmar',
+        '/modules/libmar/sign/verifymar',
+        '/security/nss/lib/nss/nss3',
+        '/security/nss/lib/util/nssutil3',
     ]
+    OS_LIBS += CONFIG['NSPR_LIBS']
 
 USE_LIBS += [
     'mar',
 ]
 
 if CONFIG['MOZ_NATIVE_BZ2']:
     OS_LIBS += CONFIG['MOZ_BZ2_LIBS']
 else:
@@ -65,17 +70,17 @@ if CONFIG['MOZ_ENABLE_GTK']:
     ]
 
 if CONFIG['MOZ_WIDGET_TOOLKIT'] == 'cocoa':
     have_progressui = 1
     SOURCES += [
         'launchchild_osx.mm',
         'progressui_osx.mm',
     ]
-    OS_LIBS += ['-framework Cocoa']
+    OS_LIBS += ['-framework Cocoa -framework Security']
 elif CONFIG['MOZ_WIDGET_TOOLKIT'] == 'gonk':
     have_progressui = 1
     SOURCES += [
         'automounter_gonk.cpp',
         'progressui_gonk.cpp',
     ]
     DISABLE_STL_WRAPPING = True
     OS_LIBS += [