1259457 - Remove AWS TLS fingerprint from hgrc

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

https://github.com/mozilla/build-puppet/blob/master/modules/mercurial/templates/hgrc.erb#L32

is no longer accurate for at least one AWS endpoint.  Likely they are swapping in a new certificate for all endpoints.  For the moment, since we can't support fingerprints for multiple certificates, we should remove this line from the configuration and re-deploy the image.

Once the certificates have stabilized, we can add a fingerprint back in.

Comment 1

[Dustin J. Mitchell [:dustin] (he/him)]

Attachment: MozReview Request: Bug 1259457: remove no-longer-current host fingerprint; r?aselagea

Review commit: https://reviewboard.mozilla.org/r/42187/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/42187/

Comment 2

[Alin Selagea [:aselagea]]

Comment on attachment 8734374 [details]
MozReview Request: Bug 1259457: remove no-longer-current host fingerprint; r?aselagea

Looks good.

Comment 3

[Carsten Book [:Tomcat]]

just as sheriffs info this is causing the  abort: certificate for s3-us-west-2.amazonaws.com has unexpected fingerprint 1a:0e:4a:64:90:c1:d0:2f:79:46:95:b5:17:dc:63:45:cf:19:37:bd retry on various trees

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

remote:   https://hg.mozilla.org/build/puppet/rev/fffb152c9df5
remote:   https://hg.mozilla.org/build/puppet/rev/2c5fe06f11c5

Alin is deploying.

Comment 5

[Alin Selagea [:aselagea]]

Started the scripts for regenerating the following AMIs:
    - aws_manager-av-linux64-ec2-golden
    - aws_manager-y-2008-ec2-golden
    - aws_manager-b-2008-ec2-golden
    - aws_manager-b-2008-ec2-golden
    - aws_manager-try-linux64-ec2-golden

Comment 6

[Alin Selagea [:aselagea]]

av-linux64, y-2008, bld-linux64 and try-linux64 have completed successfully, b-2008 is still in progress.

Comment 7

[Alin Selagea [:aselagea]]

All the five AMIs mentioned above have been regenerated.