1687996 - Automatically add Apple's "websites-with-shared-credential-backends" data to Remote Settings

Status: RESOLVED FIXED

(Toolkit :: Password Manager, task, P2)

Description

[Tim Giles [:tgiles]]

Since Apple has open sourced various resources for password managers, we want to utilize this data to improve the password manager experience by allowing allow login credentials to be used across multiple domains (i.e., realms).

We will need the following:

1. Set up a new Kinto account for a script to authenticate and edit records in the "websites-with-shared-credential-backends" collections
2. Create a script to pull the latest "websites-with-shared-credential-backends" data from Apple's repo
3. Determine where this script should live
4. Notify ops of the script's location, since we'll need their help in setting up the automation to run the script once every two weeks

Comment 1

[Tim Giles [:tgiles]]

Hey Mat,

Do you have a recommendation for where this update script should live? In the example bug, the script ends up living on Github but the password manager codebase is exclusively in tree (as far as I can tell). I assume putting the update script in tree wouldn't be a problem, but just wanted to make sure.

Thanks!

Comment 2

[Mathieu Leplatre [:leplatrem]]

Hi Tim,

I think it's more a question for Sven. I'm not aware of the current deployments/setup for scripts that are written in JavaScript.

I imagine that pulling the script from mozilla-central on each execution is not a major issue, as long as the installation of dependencies is trivial and robust. Building and publishing a Docker image could also be an option.

Comment 3

[Sven Marnach]

What exactly does "in tree" mean? In mozilla-central on HGMO?

From an ops perspective, all we need is a Docker image we can run. Our usual setup is to have code on GitHub with automated builds that push to Docker Hub, and we pick up the image from there. We also have a few releng tools that live on HGMO which are built on Taskcluster and push images to Docker Hub.

We will have to discuss the exact setup with security. For images built with Circle CI, we verify that the image pulled from Docker Hub was actually built on Circle CI, so that a breach of Docker Hub alone wouldn't be enough to ran random code in our production envs. How strict we need to be with your use case depends on how sensitive the data in the new RS collection is, and someone from security will make the call what's acceptable.

Comment 4

[Sven Marnach]

Arg, looks like I clicked the wrong button again.

Comment 5

[Tim Giles [:tgiles]]

(In reply to Sven Marnach from comment #3)

What exactly does "in tree" mean? In mozilla-central on HGMO?

Apologies, I've always heard mozilla-central on HGMO be referred to as "in tree", but yes I mean mozilla-central on HGMO. Thanks for the clarification!

From an ops perspective, all we need is a Docker image we can run. Our usual setup is to have code on GitHub with automated builds that push to Docker Hub, and we pick up the image from there. We also have a few releng tools that live on HGMO which are built on Taskcluster and push images to Docker Hub.

I haven't used Docker too much, so I'm not too familiar with it. It looks like turning a NPM package into a Docker image is trivial though, so hopefully won't be an issue when I need to hand over the update script/docker image.

We will have to discuss the exact setup with security. For images built with Circle CI, we verify that the image pulled from Docker Hub was actually built on Circle CI, so that a breach of Docker Hub alone wouldn't be enough to ran random code in our production envs. How strict we need to be with your use case depends on how sensitive the data in the new RS collection is, and someone from security will make the call what's acceptable.

Copy that. Who do I need to reach out to on security to start this conversation?

Thanks for the info Sven!

Comment 6

[Sven Marnach]

I guess this will also be :arroway, as mentioned on bug 1687813. We should come up with a proposal how we want to set this up, and then we can have that proposal reviewed. I'm happy helping to dockerize this script – I'm pretty sure this is going to be quite easy.

Looks like we plan to built the images on Taskcluster. I've never used Taskcluster for anything at all, but I'll try and find other examples of Docker images built there.

Comment 7

[Tim Giles [:tgiles]]

Attachment: Bug 1687996 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem

Comment 8

[Phabricator Automation]

Comment on attachment 9204273 [details]
Bug 1687996 - Add websites-with-shared-credential-backends dump to tree. r=leplatrem

Revision D103105 was moved to bug 1693878. Setting attachment 9204273 [details] to obsolete.

Comment 9

[Tim Giles [:tgiles]]

This is fixed by bug 1716392.