1558082 - Port bug 1471004 - notarized macOS builds in automation

Status: RESOLVED FIXED

(Thunderbird :: Build Config, enhancement)

Description

[Rob Lemley [:rjl]]

Notarized builds will be an Apple requirement for all software beginning with macOS 10.15.

Comment 1

[Rob Lemley [:rjl]]

Attachment: signing-worker-aliases.patch

This can land now as the corresponding change has landed in M-C at
https://hg.mozilla.org/mozilla-central/rev/6487aeb66175

Try run:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=9f227ccebd736c323c4f91dead10015f97e2ab33

Comment 2

[Rob Lemley [:rjl]]

Attachment: Bug 1558082 - Port bug 1471004: add notorization workerType aliases. r=aki

Ported from D33856

Comment 3

[Rob Lemley [:rjl]]

Attachment: Bug 1558082 - Port bug 1471004: move mac signing tasks to notarization/iscript pool. r=aki

Ported from D33857

Depends on D34634

Comment 4

[Rob Lemley [:rjl]]

Attachment: Bug 1558082 - Port bug 1471004: beetmove macosx pkg installer. r=aki

Ported from D33858

Depends on D34635

Comment 5

[Rob Lemley [:rjl]]

Attachment: Bug 1558082 - Port bug 1471004: add entitlements url for hardened runtime signing. r=aki

Use an in-tree entitlements file (path is relative to $moztopsrcdir).
Use the same files as Firefox. There shouldn't be any changes needed for
Thunderbird.

Ported from D33859

Depends on D34636

Comment 6

[Rob Lemley [:rjl]]

Attachment: Bug 1558082 - Port bug 1471004: use worker-type aliases for signing. r?darktrojan

Ported from m-c:6487aeb66175

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/70432a0d53dc
Port bug 1471004: use worker-type aliases for signing. r=darktrojan
https://hg.mozilla.org/comm-central/rev/3cfd13094036
Port bug 1471004: add notorization workerType aliases. r=aki
https://hg.mozilla.org/comm-central/rev/e30f66e0e0d6
Port bug 1471004: move mac signing tasks to notarization/iscript pool. r=aki
https://hg.mozilla.org/comm-central/rev/afd5ed44f8ba
Port bug 1471004: beetmove macosx pkg installer. r=aki
https://hg.mozilla.org/comm-central/rev/d1433086b124
Port bug 1471004: add entitlements url for hardened runtime signing. r=aki

Comment 8

[Jorg K (CEST = GMT+2)]

Worked in try
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=d1433086b124fed82e3a4883861648012e5e61fc
didn't work on C-C
https://treeherder.mozilla.org/#/jobs?repo=comm-central&revision=d1433086b124fed82e3a4883861648012e5e61fc

So we're hosed :-(

Comment 9

[Aki Sasaki (not active)]

Attachment: Bug 1558082 - fix thunderbird scopes. r=tomprince

and another errant depsigning

Comment 10

[Aki Sasaki (not active)]

Should be fixed now. I canceled the graph and reran the decision task.

Comment 11

[Jorg K (CEST = GMT+2)]

Thanks!

Comment 12

[Rob Lemley [:rjl]]

Attachment: mac_entitlements_by-release-level.patch

This is being done in M-C in anticipation of an uplift to esr68.

https://hg.mozilla.org/integration/autoland/rev/fa57eb4a347c

Comment 13

[Geoff Lankow (:darktrojan)]

Does this need to land when the m-c patch does?

Comment 14

[Jorg K (CEST = GMT+2)]

You mean the merge of the patch in bug 1471004 comment #31. I'll watch it.

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/8a97b511da21
Use by-release-level to select mac entitlements config. r=darktrojan DONTBUILD

Comment 16

[Jorg K (CEST = GMT+2)]

The five changesets from comment #7 and comment #15 need to go to c-esr68, right? See Mozilla uplift in bug 1471004 comment #36.

Comment 17

[Jorg K (CEST = GMT+2)]

https://hg.mozilla.org/releases/comm-esr68/rev/562c941aa8a82d03ed77064af9e4ab4604a5ca88
https://hg.mozilla.org/releases/comm-esr68/rev/a3da317f0e30420364cbde8b6d24e9e81a83d969
https://hg.mozilla.org/releases/comm-esr68/rev/9f4b61cb9b39f5fc10ee9d1dda4b42346e2dea51
https://hg.mozilla.org/releases/comm-esr68/rev/b4bbb0de6efa65516097528ba04231ceeaad31a3
https://hg.mozilla.org/releases/comm-esr68/rev/f73895b32321676a3fdf6faa89b4c518fa96e5ed
https://hg.mozilla.org/releases/comm-esr68/rev/5795ee250a6f64beb3cb29aedf5dc7ecf7eb6ec8

Looks like uplifting this was the right thing to do, clearing NI.

Comment 18

[Jorg K (CEST = GMT+2)]

https://hg.mozilla.org/comm-central/rev/8a97b511da21 is on 68 and 70, but not 69 yet since bug 1471004 comment #33 isn't on m-b 69 yet.

Comment 19

[Rob Lemley [:rjl]]

Pieces of this need uplifting to comm-esr60 per bug 1471004 comment 46.

From C-C (they need to be applied in this order)
#1 - e30f66e0e0d6
#2 - d1433086b124
#3 - 8a97b511da21

Try job here:
https://treeherder.mozilla.org/#/jobs?repo=try-comm-central&revision=8f6b30a8f69c788f0377c22446bf9fabcb60d562

I'll note that some of those are failing, like the symbols upload. I believe that's because it's a try job.

Comment 20

[Jorg K (CEST = GMT+2)]

Comment on attachment 9078480 [details] [diff] [review]
mac_entitlements_by-release-level.patch

Thanks, very pro-active. I'll take note to uplift these when I'm do the merge on m-esr60. Approved goes for two of the other patches, too, as per comment #19.

Comment 21

[Jorg K (CEST = GMT+2)]

TB 60.9 ESR:
https://hg.mozilla.org/releases/comm-esr60/rev/ce375b76e006757c272f83d237c23aef6b33e9d3
https://hg.mozilla.org/releases/comm-esr60/rev/91c99c5e2ccf481f38fb672d4ec0aadbd711eda7
https://hg.mozilla.org/releases/comm-esr60/rev/53e9ac7ed1b72fe5467f1b098c813cb1bde3ff47