1408003 - Update hgext/configwizard with new BMO cert hash

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, enhancement)

Description

[Kendall Libby [:fubar] (he/him)]

https://dxr.mozilla.org/hgcustom_version-control-tools/search?q=sha256%3A10%3A95%3Aa8%3Ac1%3Ae1%3Ac3%3A18%3Afa%3Ae4%3A95%3A40%3A99%3A11%3A07%3A6d%3Ae3%3A79%3Aab%3Ae5%3Ab0%3A29%3A50%3Aff%3A40%3Ae8%3Ae8%3A63%3Ac4%3Afd%3Af3%3A9f%3Acb&redirect=true

hgext/configwizard/__init__.py and hgext/configwizard/tests/test-security.t both contain BMO's SSL cert hash and need to be updated. 

New cert has not been acquired yet; will update this bug when we have it.

Comment 1

[Kendall Libby [:fubar] (he/him)]

:gps/glob, do you know where configwizard is used? does automaton use it, or devs? 

trying to coordinate w/ webops; we think the default is that the old cert goes bad 48hrs after the renewal happens, but I'm having them double check on that

Comment 2

[Gregory Szorc [:gps]]

configwizard is purely for developers. And it only runs when developers run `mach mercurial-setup`. It is reasonable to have a delay of several hours between the cert changing and configwizard updating. But if we can minimize that window, it would be nice.

I don't think any part of automation has Mercurial speaking to BMO. </knocks_on_wood>

Comment 3

[Kendall Libby [:fubar] (he/him)]

We'll find out; the new BMO certificate has been uploaded to zeus and put into production. New SHA2 hash is 95:BA:0F:F2:C4:28:75:9D:B5:DB:4A:50:5F:29:46:A3:A9:4E:1B:56:A5:AE:10:50:C3:DD:3A:AC:73:BF:4A:D9 (and you can go verify that in your browser).

Comment 4

[Kendall Libby [:fubar] (he/him)]

Attachment: hgext: Update pinned bugzilla.mozilla.org certificate (bug 1408003),

Review commit: https://reviewboard.mozilla.org/r/192666/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/192666/

Comment 5

[Gregory Szorc [:gps]]

Comment on attachment 8921667 [details]
hgext: Update pinned bugzilla.mozilla.org certificate (bug 1408003),

https://reviewboard.mozilla.org/r/192666/#review197906

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/f5684429fc38
hgext: Update pinned bugzilla.mozilla.org certificate , r=gps