1324510 - Enable SHA384 MAR signing on Oak

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Rail Aliiev [:rail]]

According to https://bugzilla.mozilla.org/show_bug.cgi?id=1105689#c42 we need to enable SHA384 MAR signing on Oak. This will also require a watershed in Balrog.

Comment 1

[Rail Aliiev [:rail]]

Something like https://gist.github.com/rail/46e66ecb78463f8e4a9d90e012ee17d5 should do the trick. Funsize will require more work.

Comment 2

[Rail Aliiev [:rail]]

Nick, mind if I merge m-c to oak and land some patches to test this?

Comment 3

[Rail Aliiev [:rail]]

Robert, I'd like to test the following update scenario on Oak. What do you think? Is there anything missing?

1) land the patches from bug 1105689
2) wait for a nightly build. It will be signed with sha1
3) land something like https://gist.github.com/rail/46e66ecb78463f8e4a9d90e012ee17d5 to enable new signing format
4) wait for the following nightly to test the update

One caveat, still need to address the partial updates support, which is bug 1325095. I may consider fixing it first.

Comment 4

[Robert Strong (they/them - no direct email)]

That all seems correct.

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

I'm not using Oak since the Mac single-arch work finished up. Normally you'd ask rstrong, and at the moment mhowell/agashlin who are testing the stub streamlining.

Comment 6

[Rail Aliiev [:rail]]

Abandoning for now until we clarify the requirements.

Comment 7

[Rail Aliiev [:rail]]

(In reply to Rail Aliiev [:rail] ⌚️ET - PTO in August from comment #3)
> Robert, I'd like to test the following update scenario on Oak. What do you
> think? Is there anything missing?
> 
> 1) land the patches from bug 1105689
> 2) wait for a nightly build. It will be signed with sha1
> 3) land something like
> https://gist.github.com/rail/46e66ecb78463f8e4a9d90e012ee17d5 to enable new
> signing format
> 4) wait for the following nightly to test the update
> 
> One caveat, still need to address the partial updates support, which is bug
> 1325095. I may consider fixing it first.

and we also need ot land the certs from bug 1366007

Comment 8

[Rail Aliiev [:rail]]

Attachment: exports-2017-06-13-mar384-bug1366007.tar.gz

Copying the new public certs here in case someone doesn't have access to the original bug.

Comment 9

[Robert Strong (they/them - no direct email)]

I have the certs already in my patches and I landed them on oak for testing.

Comment 10

[Robert Strong (they/them - no direct email)]

This bug is fixed. :)