1226641 - Release Promotion should sign the signing tasks

Status: RESOLVED FIXED

(Release Engineering :: Release Automation, defect)

Description

[Justin Wood (:Callek)]

To support the hardening we did for funsize (c.f. https://github.com/mozilla/funsize/pull/24/files ) we need to sign the signing tasks.

This will require puppet changes too, ala http://hg.mozilla.org/build/puppet/rev/4b09a04d4a3d

Comment 1

[Justin Wood (:Callek)]

Noteworthy, https://github.com/mozilla/signingworker/pull/12/files means that we currently must use the same key as we use for funsize.

That should be ok...

Comment 2

[Justin Wood (:Callek)]

Attachment: [tools] WIP

This is untested, and my WIP....

Comment 3

[Justin Wood (:Callek)]

Attachment: [puppet] WIP

Comment 4

[Justin Wood (:Callek)]

Attachment: [releasetasks] merely a WIP

This PR too, is untested, and will need tests written. I just wanted to get it up prior to mozlando.

Comment 5

[Jordan Lund (:jlund)]

Comment on attachment 8696076 [details] [diff] [review]
[puppet] WIP

Review of attachment 8696076 [details] [diff] [review]:
-----------------------------------------------------------------

::: modules/releaserunner/manifests/init.pp
@@ +79,4 @@
>              owner     => "${users::builder::username}",
>              group     => "${users::builder::group}",
>              source    => "puppet:///modules/$module_name/docker-worker-pub.pem"
> +        # XXX: Todo name funsize_signing_pvt_key better for current use-case

++

Comment 6

[Justin Wood (:Callek)]

Attachment: [tools] pass signing key down

Comment 7

[Justin Wood (:Callek)]

This looks to be working

Comment 8

[Justin Wood (:Callek)]

Had the following in this comment for a long while, unsubmitted:

https://hg.mozilla.org/build/puppet/rev/85a0ac317be3
https://hg.mozilla.org/build/puppet/rev/41efb71f3c7e