1670031 - hgmo SSL certificate renewal work (Oct 2020)

Status: RESOLVED FIXED

(Developer Services :: Mercurial: hg.mozilla.org, task)

Description

[Connor Sheehan [:sheehan]]

Tracking bug for any work related to the SSL cert renewal on Monday, Oct 12.

Edit: copy-able config for manual updates to the hgrc:

[hostsecurity]
hg.mozilla.org:fingerprints = sha256:FF:E7:8D:93:E9:56:3C:C0:19:FC:00:4C:18:B9:86:E5:08:E5:10:F5:E2:EA:48:E8:22:D3:A3:3A:CA:99:C3:4C, sha256:17:38:aa:92:0b:84:3e:aa:8e:52:52:e9:4c:2f:98:a9:0e:bf:6c:3e:e9:15:ff:0a:29:80:f7:06:02:5b:e8:48

Comment 1

[Connor Sheehan [:sheehan]]

Attachment: configwizard: add new sha256 fingerprint (Bug 1670031) r?dhouse,zeid

Add the new certificate to configwizard, so users can run
mach vcs-setup and have the new cert pinned in their hgrc.

Comment 2

[Connor Sheehan [:sheehan]]

Attachment: ansible/hg-web: update pinned SSL cert in hgrc template (Bug 1670031) r?dhouse,zeid

Updates the fingerprints in the hgweb hgrc file.

Depends on D92968

Comment 3

[Connor Sheehan [:sheehan]]

Attachment: configwizard: update the SHA1 fingerprint (Bug 1670031) r?dhouse,zeid

This change will need to be landed post-swap since older clients
can't pin multiple SHA1 certs.

Bug 1670034 tracks removal of this feature altogether, but for now
it stays as-is.

Depends on D92969

Comment 4

[Connor Sheehan [:sheehan]]

Attachment: docs: update standalone doc with SSL cert info (Bug 1670031) r?dhouse,zeid

Depends on D92970

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/4a21d2b14392
configwizard: add new sha256 fingerprint r=dhouse,zeid
https://hg.mozilla.org/hgcustom/version-control-tools/rev/237f1bfdb051
ansible/hg-web: update pinned SSL cert in hgrc template r=dhouse,zeid

Comment 6

[David Lawrence [:dkl]]

Attachment: GitHub Pull Request

Comment 7

[David Lawrence [:dkl]]

The content of attachment 9180540 [details] has been deleted for the following reason:

test attachment - please disregard

Comment 8

[David Lawrence [:dkl]]

Attachment: GitHub Pull Request

Comment 9

[Connor Sheehan [:sheehan]]

Updated the hgfingerprint TC secret to include the fingerprint of the new certificate.

Comment 10

[Connor Sheehan [:sheehan]]

The new certificate is live.

Comment 11

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/fec47274ac0a
configwizard: update the SHA1 fingerprint r=dhouse,zeid
https://hg.mozilla.org/hgcustom/version-control-tools/rev/3d949575c04e
docs: update standalone doc with SSL cert info r=dhouse,zeid

Comment 12

[Glenn Watson [:gw]]

I just hit this on a wrench CI job - https://treeherder.mozilla.org/#/jobs?repo=try&revision=e8952d9192afb4830a99ed7cc46a1d954733a63e&selectedTaskRun=CINL3wGHRfqpKgW4qc8XKg.0

Comment 13

[Kyle Huey [:khuey]]

Can you please update FALLBACK_FINGERPRINT (in taskcluster/scripts/run-task) to the now correct value? I sent email about this to dev-platform and got no response.

Comment 14

[Connor Sheehan [:sheehan]]

Attachment: Bug 1670031: update fallback fingerprint in `run-task` r?zeid

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/fe05e2b8652b
update fallback fingerprint in `run-task` r=zeid

Comment 16

[Kyle Huey [:khuey]]

Thanks!

Comment 17

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/fe05e2b8652b

Comment 18

[Kartikaya Gupta (email:[e-mail])]

A try push based on very recent autoland (from this morning) is still showing a bunch of jobs erroring out with fingerprint errors: https://treeherder.mozilla.org/#/jobs?repo=try&group_state=expanded&revision=b6ab677d0e1b44470483b3fd4d7d74564b6b0ca7&searchStr=windows%2C10%2Copt

Comment 19

[Julien Cristau [:jcristau]]

https://hg.mozilla.org/releases/mozilla-beta/rev/cef80e67e189

Comment 20

[Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧]

The version-control-tools repo also has a signed version of the vcs-server-info file, which is referenced by the documentation; this is now out-of-date. It was signed with a key belonging to [e-mail], with the idea that it would eventually move to a more robust form of signing, but gps is no longer at Mozilla and the public key seems to have been removed from keyservers that allow deletion, so this has been somewhat broken for a while now.

Should I file a separate bug for updating or removing that file, or do you want to handle that as part of this bug?

(For context, I wasn't immediately affected by the cert change because I primarily use Git, but some tools like mach lint will clone from hg.m.o over https.)

Comment 21

[Connor Sheehan [:sheehan]]

(In reply to Jed Davis [:jld] ⟨⏰|UTC-7⟩ ⟦he/him⟧ from comment #20)

The version-control-tools repo also has a signed version of the vcs-server-info file, which is [referenced by the documentation][docs]; this is now out-of-date. It was signed with a key belonging to [e-mail], with the idea that it would eventually move to a more robust form of signing, but gps is no longer at Mozilla and the public key seems to have been removed from keyservers that allow deletion, so this has been somewhat broken for a while now.

Should I file a separate bug for updating or removing that file, or do you want to handle that as part of this bug?

I'll remove these files and references in the docs as part of this bug. Thanks for bringing this up!

Comment 22

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/hgcustom/version-control-tools/rev/f82da5025556
docs: remove `vcs-server-info{.asc}` and docs references