1370612 - repackage and l10n tasks need extra cot verification

Status: NEW

(Release Engineering :: Release Automation: Other, enhancement, P1)

Description

[Aki Sasaki (not active)]

These are non-scriptworkers that can potentially modify artifacts that ship. We assume they're taking the artifacts from the upstream build-signing task; we need to verify.

Comment 1

[Aki Sasaki (not active)]

We also need this for toolchain tasks.  We have extra verification hardcoded for docker image shas, but we need a task-related solution as well.

Comment 2

[Aki Sasaki (not active)]

(In reply to Aki Sasaki [:aki] from comment #1)
> We also need this for toolchain tasks.  We have extra verification hardcoded
> for docker image shas, but we need a task-related solution as well.

bug 1382564 added sha verification for toolchain tasks, which is good. We don't verify the signatures there, however, so we need to doublecheck that the cot artifact wasn't modified before the toolchain tasks ran: ideally this would be verifying an artifact from toolchain tasks that includes shas of the upstream artifacts.