1343904 - don't require signoff from everyone for product-less permissions

Status: RESOLVED MOVED

(Release Engineering Graveyard :: Applications: Balrog (backend), enhancement, P3)

Description

[[e-mail] (:bhearsum)]

One of the rough edges to the new Multiple Signoffs system is that product-less permissions (eg: full admins) end up requiring signoff from all groups that are listed in _any_ permissions required signoff.

For example, if we have the following Permissions Required Signoffs:
* Firefox Permissions, 1 releng, 1 relman
* SystemAddons Permissions, 1 releng, 1 relman, 1 gofaster
* Thunderbird Permissions, 1 releng, 1 tbird

...then adding a full fledged admin requires signoff from 1 releng, 1 relman, 1 gofaster, and 1 tbird.

I can think of a ways to improve this, but each has drawbacks:
- Ignore signoffs for permissions that don't specify a product (lets us add full fledged admins with no oversight).
- If product isn't specified, look explictly at only Firefox permission signoffs, because those are likely to be a good set of signoffs to require (probably ends up needing relman signoff for things they don't care about, kindof hacky)
- If product isn't specified, use a sentinel value in its place. Eg: look for permissions required signoffs that apply to a "NOPRODUCT" product. This would give us the best control over this case, but it's still kindof hacky.

Comment 1

[[e-mail] (:bhearsum)]

Moved to https://github.com/mozilla-releng/balrog/issues/1075