Open Bug 1687996 Opened 3 months ago Updated 10 days ago

Automatically add Apple's "websites-with-shared-credential-backends" data to Remote Settings

Categories

(Toolkit :: Password Manager, task, P2)

task

Tracking

()

ASSIGNED

People

(Reporter: tgiles, Assigned: tgiles)

References

(Blocks 1 open bug)

Details

Attachments

(1 obsolete file)

Since Apple has open sourced various resources for password managers, we want to utilize this data to improve the password manager experience by allowing allow login credentials to be used across multiple domains (i.e., realms).

We will need the following:

  1. Set up a new Kinto account for a script to authenticate and edit records in the "websites-with-shared-credential-backends" collections
  2. Create a script to pull the latest "websites-with-shared-credential-backends" data from Apple's repo
  3. Determine where this script should live
  4. Notify ops of the script's location, since we'll need their help in setting up the automation to run the script once every two weeks
Blocks: 1120684
Depends on: 1687813
Priority: -- → P2
Severity: -- → N/A

Hey Mat,

Do you have a recommendation for where this update script should live? In the example bug, the script ends up living on Github but the password manager codebase is exclusively in tree (as far as I can tell). I assume putting the update script in tree wouldn't be a problem, but just wanted to make sure.

Thanks!

Flags: needinfo?(mathieu)

Hi Tim,

I think it's more a question for Sven. I'm not aware of the current deployments/setup for scripts that are written in JavaScript.

I imagine that pulling the script from mozilla-central on each execution is not a major issue, as long as the installation of dependencies is trivial and robust. Building and publishing a Docker image could also be an option.

Flags: needinfo?(mathieu) → needinfo?(sven)
Assignee: nobody → tgiles
Status: NEW → ASSIGNED

What exactly does "in tree" mean? In mozilla-central on HGMO?

From an ops perspective, all we need is a Docker image we can run. Our usual setup is to have code on GitHub with automated builds that push to Docker Hub, and we pick up the image from there. We also have a few releng tools that live on HGMO which are built on Taskcluster and push images to Docker Hub.

We will have to discuss the exact setup with security. For images built with Circle CI, we verify that the image pulled from Docker Hub was actually built on Circle CI, so that a breach of Docker Hub alone wouldn't be enough to ran random code in our production envs. How strict we need to be with your use case depends on how sensitive the data in the new RS collection is, and someone from security will make the call what's acceptable.

Assignee: tgiles → nobody
Status: ASSIGNED → NEW
Flags: needinfo?(sven)

Arg, looks like I clicked the wrong button again.

Assignee: nobody → tgiles
Status: NEW → ASSIGNED

(In reply to Sven Marnach from comment #3)

What exactly does "in tree" mean? In mozilla-central on HGMO?

Apologies, I've always heard mozilla-central on HGMO be referred to as "in tree", but yes I mean mozilla-central on HGMO. Thanks for the clarification!

From an ops perspective, all we need is a Docker image we can run. Our usual setup is to have code on GitHub with automated builds that push to Docker Hub, and we pick up the image from there. We also have a few releng tools that live on HGMO which are built on Taskcluster and push images to Docker Hub.

I haven't used Docker too much, so I'm not too familiar with it. It looks like turning a NPM package into a Docker image is trivial though, so hopefully won't be an issue when I need to hand over the update script/docker image.

We will have to discuss the exact setup with security. For images built with Circle CI, we verify that the image pulled from Docker Hub was actually built on Circle CI, so that a breach of Docker Hub alone wouldn't be enough to ran random code in our production envs. How strict we need to be with your use case depends on how sensitive the data in the new RS collection is, and someone from security will make the call what's acceptable.

Copy that. Who do I need to reach out to on security to start this conversation?

Thanks for the info Sven!

Flags: needinfo?(sven)

I guess this will also be :arroway, as mentioned on bug 1687813. We should come up with a proposal how we want to set this up, and then we can have that proposal reviewed. I'm happy helping to dockerize this script – I'm pretty sure this is going to be quite easy.

Looks like we plan to built the images on Taskcluster. I've never used Taskcluster for anything at all, but I'll try and find other examples of Docker images built there.

Flags: needinfo?(sven)
Depends on: 1693878

Comment on attachment 9204273 [details]
Bug 1687996 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem

Revision D103105 was moved to bug 1693878. Setting attachment 9204273 [details] to obsolete.

Attachment #9204273 - Attachment is obsolete: true
See Also: → 1704582
You need to log in before you can comment on or make changes to this bug.