1628491 - mac signers need new XCode

Status: RESOLVED INACTIVE

(Infrastructure & Operations :: RelOps: Puppet, task)

Description

[Aki Sasaki (not active)]

Our Mac signers rely on altool, which is installed as part of XCode. Apple has changed altool significantly since we've imaged our signing pool. It looks like we need to upgrade XCode to get support for bug 1620697. We should roll the new version of XCode to a single machine for testing, before rolling out to the rest of the pool.

I believe the current process involves creating a new base image, reimaging one or a handful of machines pointing at that new image to test, and optionally making that the default image when we want to roll it out everywhere. I think it's likely that we'll need to update the signers' XCode installs frequently, potentially at a faster frequency than the test or PGO pools. If that's true, and if the reimaging process is heavyweight, we may want to consider alternate solutions: update through the App Store? or otherwise update XCode without reimaging.

Comment 1

[Aki Sasaki (not active)]

Playing with some solutions in https://github.com/mozilla-releng/scriptworker-scripts/wiki/mac-update .

Comment 2

[Aki Sasaki (not active)]

We may have resolved bug 1620697 without this. We probably need to plan for when this becomes necessary, however.

Comment 3

[Jake Watkins [:dividehex]]

I agree with the thought not baking full xcode into the base image as it is currently done since building new images is a heavy process. I also think the softwareupdate tool might be a good path to explore for installing Xcode.

Comment 4

[Jake Watkins [:dividehex]]

Attachment: GitHub Pull Request - full xcode package via s3

Comment 5

[Nick Thomas [:nthomas] (UTC+12)]

For posterity, we were looking at an XCode upgrade because of altool improvements described here
https://mjtsai.com/blog/2019/07/03/
https://mjtsai.com/blog/2020/04/02/altool-4-01/
in short - XCode 11 added concurrent uploads for notarization, and defaulted to https transport.

In the end we worked around the issue in bug 1620697 but at some point we'll have to investigate how to keep current with XCode.