1546299 - Digitally sign geckodriver binaries on Mac

Status: VERIFIED FIXED

(Testing :: geckodriver, enhancement, P2)

Description

[Henrik Skupin [:whimboo][⌚️UTC+1]]

+++ This bug was initially created as a clone of Bug #1427849 +++

Bug 1427849 got signing implemented for Linux and Windows, but bug 1470607 blocks us from doing the same on Mac. Johan will continue once that other bug got fixed.

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Johan, I would be interested to know when we could get this feature. Reason is that I want to get the new job created which collects all the geckodriver binaries and offers them as artifacts on a single job. I assume that as long as this bug hasn't been implemented, I will have to look for geckodriver-repack for MacOS instead. Later it should hopefully be easy to get this dependency flipped.

Comment 2

[Johan Lorenzo [:jlorenzo]]

Hey Whimboo!

I'm sorry, I haven't worked closely from bug 1470607, deferring to Aki.

Regarding the dependencies: yeah, using geckodriver-repack for MacOS is the way to go, if you need a quick solution.

Comment 3

[Henrik Skupin [:whimboo][⌚️UTC+1]]

(In reply to Johan Lorenzo [:jlorenzo] from comment #2)

Regarding the dependencies: yeah, using geckodriver-repack for MacOS is the way to go, if you need a quick solution.

Perfect. I will handle all that on bug 1558497.

Comment 4

[Johan Lorenzo [:jlorenzo]]

I meant to NI :aki in comment 2.

Comment 5

[Aki Sasaki (not active)]

Hm. This is the first I’ve heard of this.
Mac notarization will hopefully roll out this week. Once that happens, we can add geckodriver signing to the mac build-signing tasks. (Do we need to sign localized versions or just the en-US?)

Comment 6

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Aki, that is great to hear! So we only have to sign one binary file here. There is no localization support for geckodriver. It's just English.

Comment 7

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Using the Apple Notary service for signed builds was actually done on bug 1471004, which seems to be rolled-out now.

Aki, would anyone be able to help us with the signing task? Thanks a lot.

Comment 8

[Aki Sasaki (not active)]

I'll start looking at this.

Comment 9

[Aki Sasaki (not active)]

Attachment: Bug 1546299 - add mac geckodriver signing support. r=jlorenzo

Also add the mac_geckodriver behavior, and remove the unused mac_pkg behavior.

Comment 10

[Aki Sasaki (not active)]

Green try run: https://tools.taskcluster.net/groups/LHLhyl8rRLSy9TP79h_PHg/tasks/QBFdXCxFRM-S4RaCxcDFPw/runs/1/artifacts

Comment 11

[Aki Sasaki (not active)]

Updated the mac signing pool. Once we land the in-tree patch, we'll start signing geckodriver on mac.

Comment 12

[Henrik Skupin [:whimboo][⌚️UTC+1]]

Thanks a lot for this quick patch Aki!

Comment 13

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/57281d612fe1
add mac geckodriver signing support. r=jlorenzo

Comment 14

[Noemi Erli[:noemi_erli]]

https://hg.mozilla.org/mozilla-central/rev/57281d612fe1

Comment 15

[Henrik Skupin [:whimboo][⌚️UTC+1]]

This looks great:

codesign --verify --verbose geckodriver
geckodriver: valid on disk
geckodriver: satisfies its Designated Requirement

Thanks a lot!