1508761 - Please create new dep and prod APK signing keys for "reference-browser" for TC / signingscript automated signing

Status: RESOLVED FIXED

(Cloud Services :: Operations: Autograph, enhancement)

Description

[Greg G]

Per discussion in #autograph on IRC generate new APK dep and prod keys for an app called reference-browser for automated signing with TC / signingscript and send the gpg-encrypted HAWK creds to :mhentges or :jlorenzo.

Comment 1

[Greg G]

Since this is for TC and RelEng these can be deployed in the HSM env and deployed next Wednesday with the content signature cert rotation.

Comment 2

[Greg G]

Generated the dep and rel keys and hawk creds, Added them to the autograph-hiera-sops stage and prod configs and checked locally that autograph runs with the updated configs and I can sign a test apk with all hawk creds.

Added the clients to https://mana.mozilla.org/wiki/display/SVCOPS/Autograph+and+Autograph+Edge+Clients

Sent the hawk creds gpg-encrypted to :jlorenzo to add to the signingscript configs (and who can share with :mhentges as necessary).

The updated autograph configs should deploy to prod this Wednesday (I'll block on the deploy bug once it's created).

Comment 3

[Greg G]

Attachment: geckoview_ref_browser_dep_cert.pem

Comment 4

[Greg G]

Attachment: geckoview_ref_browser_rel_cert.pem

Comment 5

[Johan Lorenzo [:jlorenzo]]

I don't think this bug needs to be private anymore. It doesn't contain sensitive information and the reference browser is already public: https://github.com/mozilla-mobile/reference-browser/