Merge pull request #120 from escapewindow/b-412

4.1.2
mozilla-releng · Jun 15, 2017 · a4ceef3 · a4ceef3
2 parents a90e74a + 047d77c
commit a4ceef3
Show file tree

Hide file tree

Showing 6 changed files with 83 additions and 92 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,16 @@
 All notable changes to this project will be documented in this file.
 This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [4.1.2] - 2017-06-14
+### Changed
+- rewrote chain of trust docs.
+
+### Fixed
+- fixed artifact list verification in `task.payload` for generic-worker tasks.
+
+### Removed
+- removed old format balrog scope.
+
 ## [4.1.1] - 2017-05-31
 ### Added
 - added `.sh` as an `ignore_suffix` for generic-worker

diff --git a/docs/releases.md b/docs/releases.md
@@ -95,11 +95,20 @@ Push!
 Someone with access to the scriptworker package on `pypi.python.org` needs to do the following:
 
 ```bash
-    # You may hit problems with this using py>=35?
-    python setup.py register sdist upload
+    # from https://packaging.python.org/tutorials/distributing-packages/#uploading-your-project-to-pypi
+    # Don't use `python setup.py register` or `python setup.py upload`; this may use
+    # cleartext auth!
+    # Using a python with `twine` in the virtualenv:
+    VERSION=4.1.2
+    # create the source tarball
+    python setup.py sdist
+    # sign the source tarball
+    gpg --detach-sign -a dist/scriptworker-${VERSION}.tar.gz
+    # upload the source tarball + signature
+    twine upload dist/scriptworker-${VERSION}.tar.gz{,.asc}
 ```
 
-That creates the new version in pypi, creates the source tarball, and uploads it.
+That creates source tarball, and uploads it.
 
 ## Puppet
 

diff --git a/requirements-prod.txt b/requirements-prod.txt
@@ -25,23 +25,20 @@ aiohttp==2.1.0 \
     --hash=sha512:f2db62cfa963ba1ccc474cc9a3d032f908071bdf921f0e734d0a8c9607d9ab00badbcd3f6d7eb1f2d622b54257610cd7c23a8216997ce79292ea466a389eecf0 \
     --hash=sha512:e388206bae63c96853e30033bfbd84d540da17d38b8f4676bca345d6c5a420ede12f28fd8e76752c8a63743b3c6e99b4975b43e960a4fd2981ecd81b0e0b364a \
     --hash=sha512:03f2ad69dbe10f7e2d70a55fc9b8b42e571356142b8b67c9026957f291ffb245dd2c9327f6fe95b8c706b4f0a318b207e4ae23c8de09cd6ddab94d48e1fd62ba \
-    --hash=sha512:bb507423225c03f0e717aa5325b70d8a6dddadb78b4c15e17e86298381775f8dd5a25450c44c75aebe3a9d3d70da8c191ddb06bf7513957c11f6e6f1dc596726 \
+    --hash=sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e \
     --hash=sha512:ab0d3c3999f52c16eac1daa2797b5ce1e98e50e7ce94f9c93c5fcd9bbc9f087636f4e3f908ecf54dea8f1cc4da44be394dae93018dba6cf5f34b8ebeeb0e8e08 \
-    --hash=sha512:bd8eea366d380b88ba2c88d2aab722cd0970d2239dd0057cf4596f472a1b1bf38aebbd6cc707379ad9b5f901f93a56c1c4dd32584cb2636af0e013aa11388e25
-appdirs==1.4.3 \
-    --hash=sha512:b79e9fa76eadee595fe47ea7efd35c4cc72f058a9ed16a95cfa4d91a52c330efba50df7a9926900bbced229cca7bbfb05bbf0a8ee1d46bac2362c98ab9a5154d \
-    --hash=sha512:964db6c9f830c9b23d78f0230c5f574f214f08faf3fd24f10ccc941d23e38de66186461d754f7effb94aa0553c25df4843c9ff5dcd375c992c322550b3d98cce
+    --hash=sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
 arrow==0.10.0 \
     --hash=sha512:a2baa23f1424b21506f3b664f0ef02d09f91b9cfaf6e0badfa544f42c750ed51136ae0e8910ac24207c0265a1b233f10a6f3cbafee3124b5f5c4fd965cfd01c0
 async_timeout==1.2.1 \
     --hash=sha512:2072caeb65a74f1a24b59a4ea905ef96d70f8fb117e3dd9c95c1107b1d67ffaa4d76b68f00364049e6e29cdb0a6d247ba0c3638ccd0a8db27bd6ee0f180f9ccb \
-    --hash=sha512:6de0b510b69c77b18284e492fc1716df75b7257ac370bcf9835742ebd288ab5fa1120629fbe0e6fc6ccfba186a021add35dbafb9a811c2e82405f98e67acacf1
+    --hash=sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
 certifi==2017.4.17 \
     --hash=sha512:9795486b9527c37e2c6448603307293047172c7317f139ebe35fb61c928bd1b51e86fa1849e09d24814cea8b54caa896a7496494139e6e5b09bf2b7bb5e87938 \
-    --hash=sha512:0bd054bb2eaa8c196a94a0b7865d2488aea1fcb5e66ddc8c776c68cfa518a198a8c67bed5b485bf55db3f55d26c0ab2b4fc07839bb9175a50cb525e25d3869a5
-chardet==3.0.3 \
-    --hash=sha512:331c63639abc0437a98eb2ec7b94b26fd3e2522ec4c12b12ec60b6e140153ed39a01e5ce13ae91dcb756edb90996ca713dd18c88f10dd0820edcb1134ad85ff7 \
-    --hash=sha512:cd9c24dc451908a91e814dd935641a53def46578341bde6a2635bf4fe3c1581340914a775c358e39a8b17259c5231e573a04e9e9c1be14331c6c765ccf35c723
+    --hash=sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
+chardet==3.0.4 \
+    --hash=sha512:bfae58c8ea19c87cc9c9bf3d0b6146bfdb3630346bd954fe8e9f7da1f09da1fc0d6943ff04802798a665ea3b610ee2d65658ce84fe5a89f9e93625ea396a17f4 \
+    --hash=sha512:cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
 defusedxml==0.5.0 \
     --hash=sha512:b72237ba3c62f6178b80fc3718f90966f3cd70c4ada6ab27f271c5ec4a5e77f9d560232223cca8f3dab0b41e1e40895f488f1cd27e0989fc49733805200450ea \
     --hash=sha512:71e1a604df9be41ded454bcdfa63610e897eb405295d7365fcddfc5f50f7572c36f0bd91a4a1fdf47d1b097637bd9fdcf08f1cdb73e2fe64eea0320a7532e452
@@ -70,57 +67,46 @@ multidict==2.1.6 \
     --hash=sha512:bb6e95f68abb201726084bdab3fc99d3fe729151489104f9b883facb5dcf1c3591e9cc0ef42ba9d48fc4b17cb4b9fa5b2b730ef92aa40820be5ff55f3576adc3 \
     --hash=sha512:19a727c156d46e9c3c31f6ed4e41353e50903ca8e6d232f04172f96640abb4e152a71c33eb6f0634782fa93a1c09586a80a8d72e641eb18d20dc782fc187a62d \
     --hash=sha512:70e6727b28d9f97ece00c46c81f6d3095befa57f09de2a400b53e8b9676561de89ffe57de4810a25a9264941678f5f139aeb25489611e09b10259aed19b616f3
-packaging==16.8 \
-    --hash=sha512:8a262a3d7e6831fb791c49acb0d0c4a61deede322df6934333d0d8abf610d5ef8bb815a8f5770e2aa833fd572291bf7b8cda1c9fb4e63f8f9a9e4a5c9788f587 \
-    --hash=sha512:d1a7b65472c7c02dd758f0c469d6c6aeea34de7b798613f7fcdf45fcccbeba1e9085cab113fa89b392a60f758f8747d13b1c265c809566990c22e61ca8db49bb
 pexpect==4.2.1 \
     --hash=sha512:94092c3fc084a1faaf51d0a0f428358e5d47669841a0d9d7d6a1f75a0779035005b02f14af2a2ab30119089f50dacef71a09b0b18643184a1dce2c0b3b60c1f8 \
     --hash=sha512:796474c87559cb9f4e2dfe72564d70c75e1aac4f57c4f3e4033a56c8842a48380ae0d5fafdad7f1ea6718b25c272fe4a611a59db44e69afb1f2bbf7e00256261
 ptyprocess==0.5.1 \
     --hash=sha512:026532900e9649df0c1a66bbf2e9332f41116dda5c08950579d457e2d705b1d32752d330bbb8eb47dc024c983fa8371090b515458b8ed29753b334b4cf0996fc \
     --hash=sha512:9e7481e8e3facde73086ef0728a57516a15b6bc2a5fb6bf6d6f892c396c9376d9d6334ee37737f3469929c4086d5678a2c5deaf44d70589d41644a98f2239dad
-pyparsing==2.2.0 \
-    --hash=sha512:251c0f0986b5328f3d0c7fd9885b4e0a7eb255bda47e720ca5e907547b9c389e788222bf839039eb2dab72a7a41347a63d102c3a671d4e63f41e8cc3009af62a \
-    --hash=sha512:6a409f429d40a5ac202d144e4150de2c80d7c7120147f603f72a4a99797d48c50822a6437f590ec5ae4418d51aa1f6b1d4e5d95a57e19bec0a127b04e4937008 \
-    --hash=sha512:502044c36b335ebb8a3ca602ce9d7645349b97bcf126196f406cdd91d420da6fec01e3cbbe7e352dfa7c3c73a2166b19673a7ffed2dd2c45dfba1f8bcffdceb0 \
-    --hash=sha512:39e6a6ca1340590bccc8a3a064017e604882432df2f662205ab6415b61cd079b7a22f68b4d4223e1ef841a46573cf1c8ebfbf5bceb480c2c2df5989e6c36779d \
-    --hash=sha512:eac6527dea38add43e4af73888542e54a8ff8eff5a2d9ac53fb5fa68da20729250da9e00359e2b5adc9ca8ce7497a4aa72c20adfca1eae4deb9f4319acb70b21 \
-    --hash=sha512:22ae2706f1bd62978949fd86d134914d8133e82e43a968b0c728d002525757b513c3bd43421f65dc3a1e1b513c9392ce7ae0f3772a75cf00bac11707649fc21a \
-    --hash=sha512:e18e50ac0e5d818e81c58cc9717c3c7fecfac2fad840196cb54db8e406fe59fcd38d746f02d20c6ca464bffa3f5bd34e8e1a92295637427fd47a56f197377666
 python-dateutil==2.6.0 \
     --hash=sha512:1fec6dd6fc00650821fd826405414bcde79e1542a53608ebd837e924b4abc147a369214ec064adbff682fc5ff67440086f3000eaa77b274c7463c3f58686ced9 \
     --hash=sha512:7d1e7a7c15bd3a4bdcc87baf88acfa02c926e3ea35fd72a0db883976c08270370d27ce7c40986748a226e3d5d31d6eb83d66489cdb0a9bb24c3e3902ed0aae62 \
     --hash=sha512:c4974c10dae33f2c85e0ef2993e94ec9250e84bd4374cdcc8c70b8eb766d4b84e24eb7558958711953469fff5b0fdb3001cb566ba853558888e9d9410034cc04
 python-gnupg==0.4.0 \
     --hash=sha512:f486ec97aee01cf46d055421211ff5704093a382155043b7ced6f809dc15d7669d5869038a1b26c5f1831076d85c929d781bc22e35ab293a14bc6e2f5f27fa32 \
     --hash=sha512:9af33647be8cdccc9c9111e3176a03142cf1f1ce55ff8992dea5115af586b81cea02ce4c4ccbb0787dd7efca5afe00cc0a7a852000e8c82cc67e2b4697fa3557
-requests==2.17.3 \
-    --hash=sha512:f363299d920f3801c65375048d2f7e48d8de80af10290f17e933c09243ffa330260686c6a557850cff12865c763ef28d8b9aafb31e6d3521787e0f15090a87d0 \
-    --hash=sha512:e1dc999aa397a6784ce657038ab9b2e8f92d8531bcf717794a2291ec6e82ec7ae6a5c26823874bb246dfcc3aeb6e83c4137bc2132facfd56aba55c4e261933cf
+requests==2.18.1 \
+    --hash=sha512:7c8be80fc7d0aaa9995653038edc90484b3c2c377e35cb00eea21bc6d2b2b15879c8caab93defb30b34901600d8de9930345ffd4ccfc13ed387d2889a19cb051 \
+    --hash=sha512:d7482ddce36ce633bee830bc8d9f9a207e1c20595378f7c60dcef01cab016a16704965f3b52e3faac63dd50fbe7c61d575742e71f51a2b8d41c1922df2dbaa06
 six==1.10.0 \
     --hash=sha512:a41b40b720c5267e4a47ffb98cdc79238831b4fbc0b20abb125504881b73ae38d5ef0215ee91f0d3582e7887244346e45da9410195d023105fccd96239f0ee95 \
     --hash=sha512:9a53b7bc8f7e8b358c930eaecf91cc5639176a699830153f586780c3e6d637f1bd31349a69c383574f99da19cb3a36524e7733a318f3572b27aefb69c6409c2e
 slugid==1.0.7 \
     --hash=sha512:8899cdae13aab7973f1bb45e044a4d39114c26e10715206f7bad928ae47e1ad4992405491a568b8536eb8147315622aad6c97d694ba253b9b51400a347e5e330
-taskcluster==1.3.2 \
-    --hash=sha512:fa6d31a6a769ad7100393183d2c9cd64995cbd6579dea0e0f6ee4ad1477f42a36bb912fec350b3672d90423713c4d3592a4cf78e1f3f10c34ceaa9523fe64f2a
+taskcluster==1.3.3 \
+    --hash=sha512:b214b034c16c9cbc5eb20d87d6e9f27f89f97fb07aa747f195351d703d8843dd63bc47d72d6f3807c7a0b1858a7c0526719cc2ce47fbe5a1c78793b2624d8115
 urllib3==1.21.1 \
     --hash=sha512:0e8ec895fa8d84d496cc2afa159ca0d2c01981a2ea2fe64356032e87bd62d1d0f2dc66633c436a864525ee474032451b7624361a8338b5da7a98c955aa1db25e \
     --hash=sha512:0d2e9c2a0b895e4e232cad5ecc645ea9fd9b70191df045a220ee1f32e284c613c6790bcdfd9e40a22ea9d25ec397278fa700a3c3747e7b04222719d50df07859
 virtualenv==15.1.0 \
     --hash=sha512:9988af801d9ad15c3f9831489ee9b49b54388e8349be201e7f7db3f2f1e59d033d3117f12e2f1909d65f052c5f1eacd87a894c6f7f703d770add3a0179e95863 \
     --hash=sha512:d7e95b8c017ec076210f30b6fd4bb44be2f7dc0257492c25bb00fee597d3ade34226d03539180f1edaf2d27b361f8efdabb92d3476e13785b890878ee1295cb2
-yarl==0.10.2 \
-    --hash=sha512:4011a311a12628296045a1d208cdcd30e0ebda7261b6f95da5152ab9b6aa4f918e072353729a976c57049869f31fb5985b7e15410b6716ff3fc191c2dffba3f7 \
-    --hash=sha512:84fbd52cfb27040a97107a819b8105f0e6d57ee15d8f15b00b59d0119ff682278bafa7a8a93055d84eebc684e52dfceebf35a20ee4a346b634db4f262e8a86e1 \
-    --hash=sha512:a6047ddefe0614c2cacbd82a0e93e6be4d2cb33f25f8d9319148feed0a7a5c6db330818c6c0a4b50c7bb0e31eccc43ff45c5ee3edccd68318cfb3dff8a9a3f84 \
-    --hash=sha512:5a3028ae0fbd40680a71fe1669d588f7e032355952e309d9a7b73e7f4db6ab83c58d91dfc5919bd3b9a7953bcd23079c82571d4d3fca1d4b8a19e3cab558d539 \
-    --hash=sha512:2850a92159c6ce49b764fd07edd9dabfc774c32634297cf7e140dbf3ebaf6610fba8507c3a253ba5885036443bfab9448578504810064e24edba4c2d5dbb06d8 \
-    --hash=sha512:6b888effdc4f7aebb8f1af2d37c5943b79833aaaa149357758243dd7fef4d85c193f774f9c38f5735fed3f1f3808bb9600e64ef304bd70d49b2083923f9dc49e \
-    --hash=sha512:e84b06f3a955c4a832820931ed70c4a4bf99e171dcee1f42a37a1c6f3f56fa2d1a5ce0a55ca684dcbcdf7fbeb8ae6226913cc6fd01fffee761b0f26e8d8e925b \
-    --hash=sha512:38b12df7878748e4ca667326d38c139bd1560682d166e3aa63adb344c01f871e122998528625c5d620fb6298b97ef241ff919a2bd89fb443f3339a0236d0484f \
-    --hash=sha512:38c146ea8b6945f0be489bb60a242fcbc8be705be7e1577a5f94a7d559d656c0c74300c0778c4335697a129f1843743d2fa579180c4d9c27495f59a6d98d5203 \
-    --hash=sha512:4799dd262c2d494015e8452cfc22712dec9e53db4eb30582f1db0cb552f9b38c679ba0bace0278a1d26da1a2b70f6d149acbb5e0cf1a754453a7be4bd8629daf \
-    --hash=sha512:874c5246877c9fdc102cbd0541796eff8dda4a809cc5c221f03a43ecbc3b1f09f62e6120556c36267b246e8dfaed5b55c87577ba425c444af839bcc832cbb35a \
-    --hash=sha512:4d864dee344574bfb81b0f239bdf78fb64b918e112ff47ff4d8567f307044a2172de94d664dcf635fa7746c90cff663cb564a18577aa439e5f30b5171335407e \
-    --hash=sha512:b385a4165b7d095e4d6e2ec5c808c6536e044fb7750000d917370ca4ca66162ed60b142e33eedb02f608bd8b005f6d1f18304992fe00702ea30dd746a0ad9a88
+yarl==0.10.3 \
+    --hash=sha512:f1aef83398d3a7d0ba3d22c30dd99cbfcf539d0108c3cd7d97ceeb3ff459d52c9cb359138e6b83a34ec5db5b18fdcc6ea8ffdf0b844e7861e1f6f53bbdc38e12 \
+    --hash=sha512:62183f9f6f97054c54a13d866ce14713ce686683e1c6f60f94a8364970b19edda028e1aed331db27c675e0235da91796b18e2fc431a7aa821f780f3341eaefe4 \
+    --hash=sha512:260eb1e030cec88700ff6839b7ae70a5a66bdf2ec6461adf90278de57d2440673fe1f8a1dd1932982ec776b814b848ec3dd8c36b8304e486f21d8e352e3329b1 \
+    --hash=sha512:a59606b65be73854c61839a84c1070a49782cefeb4ab1bde5f1ed4ac50482a4371cecdbf69d75aad790e3cce3e3a4f8ce25adaa27438127b27aa181149443114 \
+    --hash=sha512:7de9e5b2c913c8a9be6f903380d4c6d17bd6a4fb534cbfb27200fa85c74f01f5612256713531283d900b9b95ad86e030534c3b71d94b8ff1b3ced8b130f0a232 \
+    --hash=sha512:6fba78e7bb30d5be7ae42a88cd9289acd4855998b609e4f24bfff439be0f005e4a7ebadc52a86f4a302fbd9d055304bf1b50c62ff10a07699fa365db90c238f7 \
+    --hash=sha512:19fe3f9390e6e11272d1b0f822660204d19327c6038f720f2272e4928129665b77e41721a2c67cb491691773ab2cb9c025668d7d7d69303b86f7ee970a650dbc \
+    --hash=sha512:8de5ddbc567dcb3967ce72d56d7c5f471f0caaf3d02cd817e197d77447babed5e09b19f1cdd4cee86449c68565f4389aefb90d745e86f0080f4cf5056b06f1b1 \
+    --hash=sha512:3a4baa71a61af96e69943a4f1d5c5c6086d2b2d2edcaad16d064aaaec2ceebc45ff81e7068d9f2aee3ffacc4afb233f99318d8cdec6bd326ca34d9a1066b83c2 \
+    --hash=sha512:9b4c1a7e0a8e08c50ee2428b962a10798ef793f1b2ac1a032e03dda5af251374c499730d7345f513ae691d3b95c29a7bad3772053367176db356797d454984c0 \
+    --hash=sha512:21f84ae11ae5b6a05730a4eb7a0fb0ac1f037743e5a54a86325ba8b7abfa9033365f9a4e247c2b0af42f3e11f39981cd349220dc35b2d8e8e39bcfaf06ae9a5a \
+    --hash=sha512:3e83be3fbf174ffbb29af2e31a7a371bf8b195adf2d471241f6b718b9d8ce65a19db77c68bee79e57bf030a0ab2be1869980121d9b39d8546ee4665078a4e845 \
+    --hash=sha512:61df025fb906ecd95b8360bda224801baac5268215f6957837415cfe56a64c90e29bcd0b6a2dd7f253d1142643058301d362952cd3c8f8dd5f5a78a2da413177