1346359 - Script to submit transparency certs to CT

Status: RESOLVED FIXED

(Release Engineering :: Release Automation, enhancement, P1)

Description

[Richard Barnes [:rbarnes]]

For binary transparency, we need a script that can submit the transparency certificate for a release (Bug 1346354) to a certificate transparency log.

This just entails a POST request, as specified in RFC 6962:

https://tools.ietf.org/html/rfc6962#section-4.1

Comment 1

[Richard Barnes [:rbarnes]]

Attachment: Bug 1346359 - Script to submit transparency certs to CT

Review commit: https://reviewboard.mozilla.org/r/119266/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/119266/

Comment 2

[Richard Barnes [:rbarnes]]

Comment on attachment 8846176 [details]
Bug 1346359 - Script to submit transparency certs to CT

Here's a draft of the script we could put in a worker to do log submission.  Basically just cargo-culted off of the Merkle tree patch.  Does this look like about the right direction?

Comment 3

[Richard Barnes [:rbarnes]]

BTW, you should be able to try this out locally with the following:

> cd testing/mozharness
> python scripts/release/submit-to-ct.py  \
>   --chain https://ipv.sx/tmp/chain.pem  \
>   --log https://ct.googleapis.com/pilot \
>   --sct ./test.sct

Don't worry, you won't add anything to the log if you try this; the cert is already there, so the log just returns the information it already has.

Comment 4

[Rail Aliiev [:rail]]

Comment on attachment 8846176 [details]
Bug 1346359 - Script to submit transparency certs to CT

https://reviewboard.mozilla.org/r/119266/#review122048

::: testing/mozharness/scripts/release/submit-to-ct.py:2
(Diff revision 1)
> +import os
> +import requests

I don't think `requests` is installed by default. You need to install it and import in functions, see https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/scripts/release/uptake_monitoring.py#40-43 and https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/scripts/release/uptake_monitoring.py#89

::: testing/mozharness/scripts/release/submit-to-ct.py:6
(Diff revision 1)
> +import os
> +import requests
> +import sys
> +import pem
> +import base64
> +from redo import retriable

The same here

::: testing/mozharness/scripts/release/submit-to-ct.py:14
(Diff revision 1)
> +sys.path.insert(1, os.path.dirname(os.path.dirname(sys.path[0])))
> +
> +from mozharness.base.script import BaseScript
> +from mozharness.mozilla.signed_certificate_timestamp import SignedCertificateTimestamp
> +
> +@retriable(sleeptime=1, attempts=2)

Unfortunatelly you cannot use the redo decorators before you import it (runtime). You can either explicitly use `redo.retry` like in https://dxr.mozilla.org/mozilla-central/source/testing/mozharness/scripts/release/uptake_monitoring.py#113 or hide the functions somewhere after you import redo.

Comment 5

[Richard Barnes [:rbarnes]]

Comment on attachment 8846176 [details]
Bug 1346359 - Script to submit transparency certs to CT

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/119266/diff/1-2/

Comment 6

[Rail Aliiev [:rail]]

Comment on attachment 8846176 [details]
Bug 1346359 - Script to submit transparency certs to CT

https://reviewboard.mozilla.org/r/119266/#review122588

LGTM!

Comment 7

[Rail Aliiev [:rail]]

Comment on attachment 8846176 [details]
Bug 1346359 - Script to submit transparency certs to CT

https://reviewboard.mozilla.org/r/119266/#review122590

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/7df65af169f5
Script to submit transparency certs to CT r=rail

Comment 9

[Carsten Book [:Tomcat]]

https://hg.mozilla.org/mozilla-central/rev/7df65af169f5