1473429 - release-bouncer-sub fails on Try

Status: RESOLVED FIXED

(Release Engineering :: Release Automation, defect)

Description

[Aki Sasaki (not active)]

We hit a chain of trust exception because we listed project:releng:bouncer:server:staging as a restricted scope, and restricted scopes are verboten on Try.

2018-07-04T06:52:45 CRITICAL - bouncer AR4E_dPdQkm5LO7gWuoOhA: repo /try not allowlisted for scope project:releng:bouncer:server:staging!
bouncer AR4E_dPdQkm5LO7gWuoOhA has restricted privilege scope, and is_try()!
2018-07-04T06:52:45 CRITICAL - Chain of Trust verification error!
Traceback (most recent call last):
  File "/builds/scriptworker/lib/python3.6/site-packages/scriptworker/cot/verify.py", line 1821, in verify_chain_of_trust
    await trace_back_to_tree(chain)
  File "/builds/scriptworker/lib/python3.6/site-packages/scriptworker/cot/verify.py", line 1773, in trace_back_to_tree
    raise_on_errors(errors)
  File "/builds/scriptworker/lib/python3.6/site-packages/scriptworker/cot/verify.py", line 288, in raise_on_errors
    raise CoTError("\n".join(errors))
scriptworker.exceptions.CoTError: 'bouncer AR4E_dPdQkm5LO7gWuoOhA: repo /try not allowlisted for scope project:releng:bouncer:server:staging!\nbouncer AR4E_dPdQkm5LO7gWuoOhA has restricted privilege scope, and is_try()!'

- We could remove the staging scope from the set of restricted scopes for try-staging phase 1. The downside here is we may get more bouncer server conflicts from concurrent staging releases on other branches.
- We could change the Try scope to be project:releng:bouncer:server:dev or something unrestricted, and add another bouncer scriptworker pool to serve the associated workerType. However, until phase 2 we won't really have a server to point that new pool at.
- Something else that I'm not thinking of atm

Comment 1

[Aki Sasaki (not active)]

The task won't live forever, but my current failed bouncer sub task is https://tools.taskcluster.net/groups/JzDg_-vqQDei9xN7fg_wLQ/tasks/AR4E_dPdQkm5LO7gWuoOhA/runs/0/artifacts