1226019 - Modify signing-workers to look for scopes like `project:releng:signing:..`

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

This puts `releng` nicely in the scope name so that it's easy to spot and anyone modifying scopes has a big red "THINK CAREFULLY ABOUT THIS" flag (just like IT won't touch anything with "releng" in the hostname.. good sides and bad sides to that..)

This also avoids the inevitable name collision when some other user of TaskCluster wants to build a tool that involves signing things.  I mean, we're obviously the most important, but we should be nice :)

It should be relatively simple to grant anything that currently has signing:foo the project:releng:signing:foo scope, then modify signing workers to check for the latter, then remove the signing:foo scopes form task definitions, and once those tasks have completed, remove them from the roles.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Rail, is this something you could bang out at some point?

Comment 2

[Rail Aliiev [:rail]]

Sure. Do we have any deadlines?

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Nope, just a "this should get done" thing.

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

Woo, I just saw this get merged -- do you need help changing any existing roles or clients?

Comment 5

[Rail Aliiev [:rail]]

it's a intermediate change to accept both scopes.
 
so far we have only 2 consumers: 

https://github.com/mozilla/funsize/blob/master/funsize/tasks/funsize.yml
https://github.com/mozilla/releasetasks/tree/master/releasetasks/templates

Shouldn't be hard to find-and-replace once this is deployed.

I'd rather steal your brain in bug 1252365 ;)

Comment 6

[Rail Aliiev [:rail]]

I created a new client ID for funsize: project/releng/funsize/production and deployed it

Comment 7

[Rail Aliiev [:rail]]

Attachment: new scopes

Comment 8

[Rail Aliiev [:rail]]

Forgot to change the config: http://hg.mozilla.org/build/puppet/rev/f1848ca95e61