1813699 - Android V3 signatures for Fenix

Status: NEW

(Release Engineering :: Release Automation, enhancement)

Description

[Jeff Boek [:boek]]

From github: https://github.com/mozilla-mobile/fenix/issues/22448.

v3 signatures enable us to rotate signing key in case the private key leaked

Our CSO thinks we should tackle this now.

https://jira.mozilla.com/browse/FFXP-431

Do we also want this for focus-android?

┆Issue is synchronized with this Jira Task

Change performed by the Move to Bugzilla add-on.

Comment 1

[Johan Lorenzo [:jlorenzo]]

From RELENG-718:

Once signingscript has added support for v3 signing formats, we need to enable it on various products by changing the format they’re signing with. This will need to be done for at least: Fenix, Focus/Klar, Reference Browser, and MozillaVPN. (There may be others, but these are the ones I came up with so far.)

Each of these defines the format in a slightly different place. Here’s where they were when I wrote this up:

• Fenix: https://github.com/mozilla-mobile/fenix/blob/main/taskcluster/ci/signing/kind.yml#L25
• Focus/Klar: https://github.com/mozilla-mobile/focus-android/blob/main/taskcluster/ci/signing/kind.yml#L22
• Reference Browser: https://github.com/mozilla-mobile/reference-browser/blob/master/taskcluster/rb_taskgraph/transforms/signing_apks.py#L25 and https://github.com/mozilla-mobile/reference-browser/blob/master/taskcluster/rb_taskgraph/transforms/signing_bundle.py#L25
• MozillaVPN: (currently does not define keyid at all – we’ll need to start sending it as keyid in the body, probably with -F “keyid=xxxxxx”)

For the browsers with multiple release channels, we should start with Nightly, and then adjust the other channels once we’re sure things are good there.

We should also coordinate with either engineers or QA when landing this, to make sure it gets tested on multiple device versions. See https://mozilla-hub.atlassian.net/browse/QA-1193 for initial testing done for this project.

Comment 2

[Johan Lorenzo [:jlorenzo]]

We'll get v3 signatures enabled on the Autograph side of things in bug 1842229.