1408484 - Sign partial updates with SHA384 on Thunderbird beta builds.

Status: RESOLVED FIXED

(Thunderbird :: Build Config, enhancement)

Description

[Tom Prince [:tomprince]]

The complete updates are signed by in-tree code which was updated to request the new format. Unfortunately, partial updates are signed by code invoked directly from buildbotcustom and build/tools so didn't get updated.

Comment 1

[Tom Prince [:tomprince]]

Attachment: Bug 1408484: Sign release partials with SHA384 when requested.

Review commit: https://reviewboard.mozilla.org/r/189232/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/189232/

Comment 2

[Tom Prince [:tomprince]]

Attachment: Bug 1408484: Don't push thunderbird betas to mirrors automatically.

This is so we avoid making work for CloudOps if we have more failures.
See https://bugzilla.mozilla.org/show_bug.cgi?id=1408244#c0.

Review commit: https://reviewboard.mozilla.org/r/189222/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/189222/

Comment 3

[Tom Prince [:tomprince]]

Attachment: Bug 1408484: Specify that Thunderbird betas should be signed with SHA384.

Review commit: https://reviewboard.mozilla.org/r/189224/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/189224/

Comment 4

[Tom Prince [:tomprince]]

Attachment: Bug 1408484: Sign release partials with SHA384 when requested.

Review commit: https://reviewboard.mozilla.org/r/189228/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/189228/

Comment 5

[Justin Wood (:Callek)]

Comment on attachment 8918403 [details]
Bug 1408484: Sign release partials with SHA384 when requested.

https://reviewboard.mozilla.org/r/189232/#review194552

Comment 6

[Justin Wood (:Callek)]

Comment on attachment 8918404 [details]
Bug 1408484: Don't push thunderbird betas to mirrors automatically.

https://reviewboard.mozilla.org/r/189222/#review194554

Comment 7

[Justin Wood (:Callek)]

Comment on attachment 8918405 [details]
Bug 1408484: Specify that Thunderbird betas should be signed with SHA384.

https://reviewboard.mozilla.org/r/189224/#review194556

Comment 8

[Justin Wood (:Callek)]

Comment on attachment 8918406 [details]
Bug 1408484: Sign release partials with SHA384 when requested.

https://reviewboard.mozilla.org/r/189228/#review194558

Comment 9

[Tom Prince [:tomprince]]

https://hg.mozilla.org/build/tools/rev/c46206071e151c40c3c52e3462bb9897b7dd7de2
https://hg.mozilla.org/build/buildbotcustom/rev/08cc8e74480c6350f61d95ad51de463fb9800ceb
https://hg.mozilla.org/build/buildbot-configs/rev/05b2f17c054ce9cacdbc82368375b9703ff13e02
https://hg.mozilla.org/build/buildbot-configs/rev/46d3645c2a1da2a679a3cc40401a5e1e7328e87d

Comment 10

[Tom Prince [:tomprince]]

Attachment: Bug 1408484: Re-enable automatic pushes to mirrors;

Review commit: https://reviewboard.mozilla.org/r/191902/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/191902/

Comment 11

[Tom Prince [:tomprince]]

Comment on attachment 8920945 [details]
Bug 1408484: Re-enable automatic pushes to mirrors;

https://reviewboard.mozilla.org/r/189220/#review197078

Since the issue the caused 10+ builds has been addressed, I think it makes sense to revert this. My impression was that pushing manually required a fair amount of effort, and I don't think I have access to initiate it. So I think on balance, it makes sense to have the push be automatic.

Comment 12

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 8920945 [details]
Bug 1408484: Re-enable automatic pushes to mirrors;

https://reviewboard.mozilla.org/r/189220/#review197440

Yes, I think that's fine too.

Comment 13

[Tom Prince [:tomprince]]

https://hg.mozilla.org/build/buildbot-configs/rev/5fffb61f188cc4d2e853c9650d474d3b0cbf63cc