1302376 - Update HG to 3.9.1 on Windows Testers

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Comment 1

[Amy Rich [:arr] [:arich]]

The cert expires on the 28th. We were going to try switching it on the 21st, but it's unlikely that gives us enough time to do an hg upgrade on windows testers. Instead, we're going to switch the cert on the 26th. If hg is not upgraded by that time, we will need to take a downtime to upgrade the hg configuration to change the hash for the pinned certs.

Comment 2

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: Bug1302376.patch

A patch to unpin 2008 for 2016-09-26 hg cert rotation add adds support for Puppet to manage Win 7 hg config files.

Comment 3

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: Bug1302376-2.patch

Comment 4

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: Bug1302376-3.patch

Comment 5

[Mark Cornmesser [:markco] OOO 2024/04/15]

Attachment: Bug1302376-5.patch

Comment 6

[Mark Cornmesser [:markco] OOO 2024/04/15]

Comment on attachment 8794455 [details] [diff] [review]
Bug1302376-5.patch

https://hg.mozilla.org/build/puppet/rev/01ef7df82a8a

Comment 7

[Mark Cornmesser [:markco] OOO 2024/04/15]

This has been pushed out to all testers.

Comment 8

[Mark Cornmesser [:markco] OOO 2024/04/15]

Accept for Windows 10.

Comment 9

[Alin Selagea [:aselagea]]

We only have 1 Windows 10 machine enabled at the moment. Is there any further work needed here that would prevent us from closing this bug?

Comment 10

[Mark Cornmesser [:markco] OOO 2024/04/15]

I would prefer to keep this open until we have Windows 10 do as well. 

Q: How do you want to handle the upgrade of HG for Windows 10?

Comment 11

[Gregory Szorc [:gps]]

From https://archive.mozilla.org/pub/firefox/try-builds/[e-mail]-ee7fceb927e78062f7a7d2833d2f2ab04eda7034/try-win32/try_win7_vm_test-web-platform-tests-1-bm138-tests1-windows-build164.txt.gz, it looks like Python/Mercurial can't load a trusted CA certs list.

Here is Python connecting to a server without verifying the x509 certificate: a security issue:

--17:46:53--  https://hg.mozilla.org/build/tools/raw-file/default/buildfarm/utils/archiver_client.py
           => `archiver_client.py'
Resolving hg.mozilla.org... 63.245.215.25, 63.245.215.102
Connecting to hg.mozilla.org|63.245.215.25|:443... connected.
WARNING: Certificate verification error for hg.mozilla.org: certificate signature failure
HTTP request sent, awaiting response... 200 Script output follows
Length: 12,179 (12K) [text/x-python]

    0K .......... .                                          100%    8.03 MB/s

17:46:54 (8.03 MB/s) - `archiver_client.py' saved [12179/12179]

program finished with exit code 0


And here is Mercurial failing:

17:47:48     INFO -  ensuring https://hg.mozilla.org/try@ee7fceb927e78062f7a7d2833d2f2ab04eda7034 is available at c:\slave\test\checkout
17:47:48     INFO -  (cloning from upstream repo https://hg.mozilla.org/mozilla-unified)
17:47:48     INFO -  (sharing from new pooled repository 8ba995b74e18334ab3707f27e9eb8f4e37ba3d29)
17:47:48     INFO -  applying clone bundle from https://s3-external-1.amazonaws.com/moz-hg-bundles-us-east-1/mozilla-unified/e4282badddda00fb555bd2e5300c92149434a884.packed1-gd.hg
...
17:47:48     INFO -  abort: could not find web.cacerts: C:\mozilla-build\hg\hgrc.d\cacert.pem

Comment 12

[Q]

Testing on windows 10 looks good so far.

Comment 13

[Alin Selagea [:aselagea]]

Noticed that t-w1064-ix-0002 is running 3.9.1 at the moment. Is the Mercurial upgrade process for Windows 10 already finished?

Comment 14

[Q]

It is however win 10 in build-bot is going away