1303851 - Warn if HPKP list is going to expire soon

Status: RESOLVED WORKSFORME

(Release Engineering :: Applications: Shipit, defect, P3)

Description

[Chris AtLee [:catlee]]

Shipit should warn release management if the HPKP list is going to expire soon.

On Beta, that means we should warn if the expiry is less than 60 days out.

Comment 1

[Rail Aliiev [:rail]]

We can probably add a sanity check which injects a warning into the relman email.

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

We currently have 'HPKP Expiration' checks for Beta, ESR [1], Nightly, and Release, via check_hkpk_expiry (see IT puppet). They're set up with 30 day threshold for warning, and 14 day for critical, for all branches.

[1] depends on FIREFOX_ESR in https://product-details.mozilla.org/1.0/firefox_versions.json

Comment 3

[Nick Thomas [:nthomas] (UTC+12)]

Sigh, those are nagios checks, currently in scl3 but moving somewhere in bug 1484880.

Comment 4

[Aki Sasaki (not active)]

Is this still a worry for Relman? Or do we have mitigations in place?

Comment 5

[Ryan VanderMeulen [:RyanVM]]

It's theoretically still an issue, but twice-weekly automated bumps and a 4 week cycle have all but eliminated the possibility of hitting it in practice.