1342892 - vendor occ installer artifacts from within mozilla infrastructure

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: General, task)

Description

[Rob Thijssen [:grenade (EET/UTC+0300)]]

occ downloads exe and msi installers from arbitrary web locations which creates a vulnerability point for either network failures or deliberate sabotage.

modify occ configuration to download these artifacts from an internal repository instead with a possible fallback to external urls if local downloads fail.

Comment 1

[Rob Thijssen [:grenade (EET/UTC+0300)]]

tooltool implementation now deployed: https://github.com/mozilla-releng/OpenCloudConfig/commit/8565705fe9acd98bbbfa9a44f8dbca957cdf36af

when json manifests are changed, occ ci script (https://github.com/mozilla-releng/OpenCloudConfig/blob/master/ci/update-tooltool-repo.sh) parses manifest for ExeInstall, MsiInstall & ZipInstall components which do not have an associated sha 512 hash. each of these are then downloaded from 3rd party url and uploaded to tooltool. manifests are updated to include sha 512 and a patch artifact is created to update occ with hashes. a human must manually apply, commit and push the patch to github.

when the manifests are applied during ami creation each component is checked for a sha 512 hash and if found, the tooltool artifact is used instead of the 3rd party url (which remains as a fallback).