1424254 - Please add auth:create-client:project/comm/thunderbird/releng/* to jlorenzo, tomprince, aki

Status: RESOLVED FIXED

(Taskcluster :: Operations and Service Requests, task)

Description

[Johan Lorenzo [:jlorenzo]]

In order to complete bug 1421062, I would need the ability to create new clients for thunderbird. Would you mind provinding :tomprince, :aki, and me this scope:

> auth:create-client:project/comm/thunderbird/releng/*

Thank you!

Comment 1

[Tom Prince [:tomprince]]

My client id is:

mozilla-ldap/[e-mail]

Comment 2

[Dustin J. Mitchell [:dustin] (he/him)]

I'd rather not give scopes to individual users, preferring LDAP gropus.  I could use team_releng for aki/johan.  Is there a group that includes tom that would be appropriate?

Comment 3

[Johan Lorenzo [:jlorenzo]]

I don't know in what LDAP group Tom is. Could one of you guys help?

Comment 4

[Aki Sasaki (not active)]

I'm able to view my groups via vpn+ https://ldapadmin1.private.scl3.mozilla.com/manage/dyn/users/detail/mail=[e-mail],o=com,dc=mozilla/ , but haven't found the right recipe to view Tom's. He might be able to access that, or maybe not, depending on vpn rules.

Comment 5

[Tom Prince [:tomprince]]

I'm not sure what groups I'm in, and I can't access the above link. For somebody with the appropriate access,
https://ldapadmin1.private.scl3.mozilla.com/manage/dyn/users/detail/mail=[e-mail]/ might be appropriate?

I wonder if a new LDAP group would be appropriate?

Comment 6

[Kendall Libby [:fubar] (he/him)]

(In reply to Johan Lorenzo [:jlorenzo] from comment #3)
> I don't know in what LDAP group Tom is. Could one of you guys help?

Tom's LDAP groups:
scm_level_1 scm_level_3 scm_level_2 balrog vpn_default okta_mfa vpn_balrog active_scm_level_1 all_scm_level_1 active_scm_level_3 all_scm_level_3 active_scm_level_2 all_scm_level_2

I think Tom's suggestion for a new LDAP group might be best.

Comment 7

[Johan Lorenzo [:jlorenzo]]

A new LDAP group will be added in bug 1424929. In the meantime, would you mind giving the releng group the scope, Dustin? This would allow me to continue the configuration of bug 1421062, this week.

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Done: https://tools.taskcluster.net/auth/roles/mozilla-group%3Areleng

Comment 9

[Johan Lorenzo [:jlorenzo]]

Thanks for the modification, Dustin!

I realized, we also need `project:comm:thunderbird:releng:*` just like mozilla-group:releng already has `project:releng:*`. 

Would you mind also creating a TC group for the LDAP group called "thunderbird_releng"? Could you give this group the scopes added in comment 8 + the one mentioned in this comment?

Thank you very much

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

Hm, I could swear I commented.  This is all taken care of.

Comment 11

[Tom Prince [:tomprince]]

Can you `queue:create-task:low:scriptworker-prov-v1/tb-depsigning` to `moz-tree:level:1:comm`?

Comment 12

[Dustin J. Mitchell [:dustin] (he/him)]

Done!

Comment 13

[Tom Prince [:tomprince]]

It looks like `project:comm:thunderbird:releng:signing:cert:dep-signing` is also needed for `moz-tree:level:1:comm`.

Apparently (Bug 1429505) the queue checks scope in stages, so it didn't report all needed scopes the first time around.

Comment 14

[Dustin J. Mitchell [:dustin] (he/him)]

https://tools.taskcluster.net/auth/roles/moz-tree%3Alevel%3A1%3Acomm

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/ed51ab1cf68b
Drop build-signing priority to `low` temporarily; rs=bustage-fix

Comment 16

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/cb7877246369
Realy drop build-signing priority to `low` temporarily; rs=bustage-fix

Comment 17

[Tom Prince [:tomprince]]

It looks like graphs for comm-central use a higher priority.

Can you add `queue:create-task:highest:scriptworker-prov-v1/tb-depsigning` to `moz-tree:level:3:comm`

Can you also add `queue:create-task:highest:scriptworker-prov-v1/tb-beetmover-dev` and `queue:create-task:highest:scriptworker-prov-v1/tb-balrog-dev` to `moz-tree:level:3:comm` and `queue:create-task:low:scriptworker-prov-v1/tb-beetmover-dev` and `queue:create-task:low:scriptworker-prov-v1/tb-balrog-dev` to `moz-tree:level:1:comm`

Thanks!

Comment 18

[Dustin J. Mitchell [:dustin] (he/him)]

Was this just an error in comment 11, where we expected "low" to be enough?  Or should comm-central not be using highest?

Comment 19

[Tom Prince [:tomprince]]

Actually, it looks like "very-low" is enough for level 1, but comm-central defaults to "medium" and other comm branches use higher priorities (https://searchfox.org/mozilla-central/source/taskcluster/taskgraph/transforms/task.py#648-649,653,655). I think that is correct.

I added a patch to get signing working on comm-central with the current scopes, but I would like to remove that patch and use the default priorities.

Comment 20

[Dustin J. Mitchell [:dustin] (he/him)]

Done!  Thanks for the extra info.

Comment 21

[Pulsebot]

Backout by [e-mail]:
https://hg.mozilla.org/comm-central/rev/1f4e1c314fac
Backout ed51ab1cf68b and cb7877246369 : don't adjust build-signing priority.