1457010 - partner followup - gpg signing

Status: RESOLVED FIXED

(Release Engineering :: Release Automation: Other, enhancement)

Description

[Nick Thomas [:nthomas] (UTC+12)]

We gpg sign "installers" on all platforms in the buildbot partner repack infra, and want to maintain that in taskcluster.

Comment 1

[Nick Thomas [:nthomas] (UTC+12)]

Attachment: Bug 1457010 - gpg sign partner repacks,

This adds repackage-signing on mac and linux, depending on repackage and the chunking-dummy kinds respectively, and repackage-signing is extended to create gpg signatures. The signing_dependencies are no longer added because the beetmover_repackage_partner.py transform is going to set that up manually, and it avoids duplicate targets which the schema blocks.

Beetmover can depend now on repackage-signing for all platforms, and no longer has any indirect dependencies to worry about, but does need to know about copying the .asc files as upstream artifacts.

Review commit: https://reviewboard.mozilla.org/r/239850/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/239850/

Comment 2

[Nick Thomas [:nthomas] (UTC+12)]

There's a staging release at https://tools.taskcluster.net/groups/Y-bKtkRhTNq1RxNxl85wgQ.

Comment 3

[Aki Sasaki (not active)]

Comment on attachment 8971078 [details]
Bug 1457010 - gpg sign partner repacks,

https://reviewboard.mozilla.org/r/239850/#review245556

Good job! I'm not 100% sure about the transform, but our 61.0b9 build3 has gpg sigs, so lgtm!

::: taskcluster/taskgraph/transforms/repackage_signing_partner.py:70
(Diff revision 1)
>                  build_platform=attributes.get('build_platform'),
>                  build_type=attributes.get('build_type')
>              )
>          )
>  
> +        if 'linux' in dep_job.label:

`if 'linux' in dep_job.attributes['build_platform']:` is probably preferred, as long as that works.

::: taskcluster/taskgraph/transforms/repackage_signing_partner.py:73
(Diff revision 1)
>          )
>  
> +        if 'linux' in dep_job.label:
> +            # we want the repack job, via the dependencies for the the chunking-dummy dep_job
> +            for dep in dep_job.dependencies:
> +                if dep.startswith('release-partner-repack'):

Is `dep` a dict or a string here? I'm never really sure.

Comment 4

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 8971078 [details]
Bug 1457010 - gpg sign partner repacks,

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/239850/diff/1-2/

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 8971078 [details]
Bug 1457010 - gpg sign partner repacks,

Review request updated; see interdiff: https://reviewboard.mozilla.org/r/239850/diff/2-3/

Comment 6

[Nick Thomas [:nthomas] (UTC+12)]

Comment on attachment 8971078 [details]
Bug 1457010 - gpg sign partner repacks,

https://reviewboard.mozilla.org/r/239850/#review245556

> `if 'linux' in dep_job.attributes['build_platform']:` is probably preferred, as long as that works.

Fixed.

> Is `dep` a dict or a string here? I'm never really sure.

In this case it's a dict of the form {a: a}, so I switched to explicitly using .values().

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b59f651f46ec
gpg sign partner repacks, r=aki

Comment 8

[Nick Thomas [:nthomas] (UTC+12)]

https://hg.mozilla.org/projects/maple/rev/c42185866273efd0e9f0b0823b8da5bec3b2b661

Comment 9

[Andreea Pavel [:apavel]]

https://hg.mozilla.org/mozilla-central/rev/b59f651f46ec