Join GitHub today
GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.Sign up
Bug 1380829: Added binary transparency test and template #254
MihaiTabara left a comment
Skimmed this at first glance and looks overall good. You need to rebase this againast latest HEAD as you're a bit behind. Let me know when this is final and I can look again. Nice work so far, btw
MihaiTabara left a comment •
c) once you have it in b), you need to add within release-runner under tools, in three different places:
c1) in the release runner kwargs https://hg.mozilla.org/build/tools/file/tip/buildfarm/release/release-runner.py#l431
c2) in the (manual generative) release runner too - https://hg.mozilla.org/build/tools/file/tip/buildfarm/release/releasetasks_graph_gen.py#l36
c3) in the sanity kwargs checker - https://hg.mozilla.org/build/tools/file/tip/lib/python/kickoff/__init__.py#l292
Please let me know if this doesn't make sense and I can follow-up with more details.
Thanks for the thorough review Mihai. I'd like to propose we turn on binary transparency only on Firefox desktop betas at first, producing an artifact that we don't publish into firefox/releases/, and still in a staging mode (ie the certs are do not look like production). That way the task doesn't block the push to releases, and doesn't force the pace of the security team's work, while still maintaining steady progress for us. We have on our TODO list to convert to proper scopes (and update the scriptworker) prior to moving out of staging mode with the certificate issuing, but I'm wondering if you'd prefer that was completed before we enabled the task.
Sorry for delays in answering. So sounds like we're very close
i) turning this on for Firefox beta only in yet a "staging mode" sounds good to me. As far as I can tell, we'll be adding a new task that runs after
ii) updating later on the scopes & workerType sounds good to me.
iii) if you really want to test this through in proper staging, we can land this on
Now - strictly related to this PR, there is only one more thing left to be done:
2fbd309 is good but not enough. I'm afraid we need this variable flipped for all firefox config files from https://github.com/mozilla-releng/releasetasks/tree/master/releasetasks/release_configs. That is:
If we don't do this, on 7th of August we'll hit this on esr52 build second-graph we'll manually generate as https://hg.mozilla.org/build/tools/file/tip/buildfarm/release/releasetasks_graph_gen.py will fail for not knowing who
Speaking of which, this reminds me I need to follow-up with a cleanup PR to kill esr45 configs with fire!
Now, suppose we're done with this change as well, the following things need to happen in order:
Ideally (but not necessarily needed) - for tools, to avoid any linter errors or whatever alike, you can fork https://github.com/mozilla/build-tools and:
a) either tox and run unit tests locally to make sure they pass
We can coordinate for a common timezone ground here if you want these days to do this together.