1377350 - Please add signing-related scopes to try

Status: VERIFIED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Johan Lorenzo [:jlorenzo]]

In bug 1374589, we're enabling XPCShell on Windows which require signed builds. As a consequence, we'll have to allow try:

> queue:create-task:*:scriptworker-prov-v1/signing-linux-v1 
> project:releng:signing:cert:dep-signing

Before adding these scopes, Callek should make a first pass of review on bug 1374589. NI'ing him here to confirm once he's done.

Comment 1

[Justin Wood (:Callek)]

Looking at https://bugzilla.mozilla.org/show_bug.cgi?id=1374787 and not seeing any depsign servers existing I was hesitant.

However I was just pointed at https://bugzilla.mozilla.org/show_bug.cgi?id=1366094#c33 which unblocks my concern.  I suspect the `queue:` scope is mistyped though, at first glance. but I have no concerns around adding those named scopes for try.

Comment 2

[Johan Lorenzo [:jlorenzo]]

> 16:55:29 <jlorenzo> dustin: yes, the error I got called out every task priority (like queue:create-task:low:scriptworker-prov-v1/signing-linux-v1). Should we add them one by one? 
> 16:56:54 <•dustin> highest implies the rest, so you can just use htat

Hence the correct scopes should be:
> queue:create-task:highest:scriptworker-prov-v1/signing-linux-v1
> project:releng:signing:cert:dep-signing

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Per irc note that everything else for try is "very-low" priority, I added

> queue:create-task:very-low:scriptworker-prov-v1/signing-linux-v1
> project:releng:signing:cert:dep-signing

Comment 4

[Dustin J. Mitchell [:dustin] (he/him)]

..to role moz-tree:level:1

Comment 5

[Johan Lorenzo [:jlorenzo]]

Thanks for spotting the issue!

My bad, I also got the worker wrong. Would you mind changing it to:
> queue:create-task:very-low:scriptworker-prov-v1/depsigning
?

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

fixed

Comment 7

[Johan Lorenzo [:jlorenzo]]

Per [1], we also need :
> project:releng:signing:format:sha2signcode
> queue:route:project.releng.funsize.level-1.*

I confirmed with Callek that no other funsize route is needed. I know we also don't need other type of signing than sha2signcode.

[1] https://treeherder.mozilla.org/logviewer.html#?job_id=111981149&repo=try&lineNumber=1234

Comment 8

[Johan Lorenzo [:jlorenzo]]

https://tools.taskcluster.net/groups/HshDmBOVTAig9kArMgH_9g/tasks/HshDmBOVTAig9kArMgH_9g/details is green! Thank you very much Dustin!