1491026 - Convert .taskcluster.yml to json-e for android-components

Status: RESOLVED DUPLICATE of bug 1486089

(Release Engineering :: General, defect)

Description

[Mihai Tabara [:mtabara]⌚️GMT]

The work here is blocked by bug TODO. Once that's done, we need to swithc to json-e for enhanced security.

Copy-pasting from Johan's summary here[1]:

===
See example: mozilla-mobile/fenix#64 + followup fix mozilla-mobile/fenix#65

Once bug 1486090 is done, we should convert .taskcluster.yml to the new format.

json-e is a way to templatize JSON (therefore YAML) data. taskcluster-github now exposes it: https://docs.taskcluster.net/docs/reference/integrations/taskcluster-github/docs/taskcluster-yml-v1. Migrating to this format enables extra-security checks when signing APKs. In summary, signing tasks are run on high-security workers called scriptworker https://github.com/mozilla-releng/scriptworker. These workers trace the task definition back to .taskcluster.yml in the repo. This way, it knows if someone try to spin a release that doesn't come from the repo.
===

[1]: https://github.com/mozilla-mobile/android-components/issues/763

Comment 1

[Mihai Tabara [:mtabara]⌚️GMT]

I think we can close this as part of bug 1486089, right?

Comment 2

[Johan Lorenzo [:jlorenzo]]

That's right. The conversion was done in bug 1486089. Thank you for tracking this, I forgot about this bug.