1323732 - make taskcluster windows builds run with MOZ_UPDATER=, until we can sign binaries

Status: RESOLVED WONTFIX

(Taskcluster :: General, defect)

Description

[Joel Maher ( :jmaher ) (UTC -8)]

as per bug 1322705, we have a handful of tests which fail due to update.exe not being signed.  Disabling these tests are possible by setting |MOZ_UPDATER=| (or --disable-updater in the options).

In order to realistically get tests running we need to disable the updater until we are ready to sign it.

Comment 1

[Joel Maher ( :jmaher ) (UTC -8)]

I assume we would modify something in: https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/configs/builds/taskcluster_firefox_windows_32_debug.py?q=taskcluster_firefox_windows_32_debug.py&redirect_type=direct

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

So, who can work on this?

Comment 3

[Joel Maher ( :jmaher ) (UTC -8)]

I am not sure- possibly :grenade or :pmoore?  I think anyone could take this on, it would be figuring out where the taskcluster specific build configurations are and setting the right flags- I don't know where the taskcluster build specific configurations are.

Comment 4

[Joel Maher ( :jmaher ) (UTC -8)]

I noticed that we enable_signing in the tc builds:
https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/configs/builds/taskcluster_firefox_windows_32_opt.py?q=path%3Ataskcluster_firefox_windows_32_opt.py&redirect_type=single#47

I am not clear on where we would edit MOZ_UPDATER in the build configs, I imagine we would have a file for windows with options like this:
https://dxr.mozilla.org/mozilla-central/source/mobile/android/config/mozconfigs/android-x86/release#7


I see these files for windows builds:
https://dxr.mozilla.org/mozilla-central/source/browser/config/mozconfigs/win32/debug

but they are not taskcluster specific- I am not familiar with a way to add some option.  Possibly Chris or Ted would have idea on how to do this.

Comment 5

[Pete Moore [:pmoore][:pete]]

(In reply to Joel Maher ( :jmaher) from comment #4)
> I noticed that we enable_signing in the tc builds:
> https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/configs/
> builds/taskcluster_firefox_windows_32_opt.
> py?q=path%3Ataskcluster_firefox_windows_32_opt.py&redirect_type=single#47

That looks suspicious to me (as a layman) - maybe we should just turn off in this line of the config, and turn back on once we have signing implemented? We'd need to make sure to track this of course, so it doesn't get forgotten about.

Comment 6

[Joel Maher ( :jmaher ) (UTC -8)]

changing this doesn't affect results:
https://treeherder.mozilla.org/#/jobs?repo=try&revision=f112a418c60e11631498c3c979057560941ceb7b&filter-tier=1&filter-tier=2&filter-tier=3

so we need to really fix MOZ_UPDATER

Comment 7

[Rob Thijssen [:grenade (EET/UTC+0300)]]

jmaher: having read through all the comments in bug 1322705, i'm beginning to think that any approach other than enabling signing is only a stopgap. i initially thought that https://dxr.mozilla.org/mozilla-central/source/old-configure#15349 suggests that if MOZ_UPDATER env var is null, old-configure sets it to 1. i'm testing that here: https://treeherder.mozilla.org/#/jobs?repo=try&revision=f9b8007e323c8de27291a1b9c96fb2b640051326
if that's true, just setting the env vars to 0 might disable building updater.exe. if not, i might focus on joining the dots to get signing configured/working on win builds.

Comment 8

[Pete Moore [:pmoore][:pete]]

(In reply to Rob Thijssen (:grenade - GMT) from comment #7)
> jmaher: having read through all the comments in bug 1322705, i'm beginning
> to think that any approach other than enabling signing is only a stopgap. i
> initially thought that
> https://dxr.mozilla.org/mozilla-central/source/old-configure#15349 suggests
> that if MOZ_UPDATER env var is null, old-configure sets it to 1. i'm testing
> that here:
> https://treeherder.mozilla.org/#/
> jobs?repo=try&revision=f9b8007e323c8de27291a1b9c96fb2b640051326
> if that's true, just setting the env vars to 0 might disable building
> updater.exe. if not, i might focus on joining the dots to get signing
> configured/working on win builds.

This is a great idea - thanks for looking into this Rob! ++

Comment 9

[Kim Moir [:kmoir] ET]

Pete, reading through the comments it appears that we're not going to proceed on this and just enable signing in the windows tc builds.  Is this an accurate assessment?  The reason I'm asking is that this is still an item listed as required in our migration project plan.

Comment 10

[Joel Maher ( :jmaher ) (UTC -8)]

and we would need to sign the debug builds/tools as well, I want to make sure we are thinking of the whole solution.

Comment 11

[Pete Moore [:pmoore][:pete]]

Hi Kim,

Indeed - Windows signing in taskcluster should be covered by bug 1277591, so it looks like no intermediate stopgap is needed. If this changes, we can reopen this bug. Big thanks to :grenade for this.

Comment 12

[Joel Maher ( :jmaher ) (UTC -8)]

will we be signing debug builds?