1471185 - Implement COSE XPI signing in Autograph

Status: RESOLVED FIXED

(Cloud Services :: Security, enhancement)

Description

[Julien Vehent]

Add support for COSE signatures in the XPI signer, in parallel of PKCS7 signatures, then tell AMO to use it.
https://github.com/mozilla-services/autograph/pull/76

Comment 1

[Greg G]

Attachment: xpi-cose-signing PR

Comment 2

[Greg G]

Attachment: autograph-714ba248.tgz

tarball of 10 signed XPIs for commit 714ba24847bfdc0dff0ec879f18969ae05e72099 of the PR from running the build_test_xpis.sh against the stage and prod autograph configs will post QA results in the PR

Comment 3

[CosminB]

Is manual testing required on this bug? If yes, please provide some STR and the proper extension(if required) or set the “qe-verify -“ flag.

Thanks!

Comment 4

[Greg G]

(In reply to CosminB from comment #3)
> Is manual testing required on this bug? If yes, please provide some STR and
> the proper extension(if required) or set the “qe-verify -“ flag.
> 
> Thanks!

I ran through the QA myself and I'm looking to automate this eventually, but I'll keep that in mind.