1855221 - Invalid signatures on STAGE

Status: VERIFIED FIXED

(Firefox :: Remote Settings Client, defect)

Description

[Mathieu Leplatre [:leplatrem]]

console.error: services.settings:
  main/search-config Signature failed  InvalidSignatureError: Invalid content signature (main/search-config) using 'remote-settings.content-signature.mozilla.org-2023-10-21-15-55-18.chain'
console.error: services.settings:
  main/search-config local data was corrupted
console.warn: services.settings: main/search-config Signature verified failed. Retry from scratch
console.error: services.settings:
  main/search-config Signature failed again InvalidSignatureError: Invalid content signature (main/search-config) using 'remote-settings.content-signature.mozilla.org-2023-10-21-15-55-18.chain'
console.error: services.settings:
  Message: InvalidSignatureError: Invalid content signature (main/search-config) using 'remote-settings.content-signature.mozilla.org-2023-10-21-15-55-18.chain'
  Stack:
    InvalidSignatureError@resource://services-settings/RemoteSettingsClient.sys.mjs:165:5
_validateCollectionSignature@resource://services-settings/RemoteSettingsClient.sys.mjs:1017:13

This condition is not true anymore, since we switch from https://settings-cdn.stage.mozaws.net/v1/ to https://firefox.settings.services.allizom.org/ :

https://searchfox.org/mozilla-central/rev/95ec620fda8ad6e4096cac1f1a9db8653669b31d/services/settings/Utils.sys.mjs#114-116

Comment 1

[Mathieu Leplatre [:leplatrem]]

Attachment: Bug 1855221 - Fix stage server detection for trusted root hash r?jteow

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/54df1a3c7e01
Fix stage server detection for trusted root hash r=jteow

Comment 3

[Cristian Tuns]

https://hg.mozilla.org/mozilla-central/rev/54df1a3c7e01

Comment 4

[Mathieu Leplatre [:leplatrem]]

Comment on attachment 9355090 [details]
Bug 1855221 - Fix stage server detection for trusted root hash r?jteow

Beta/Release Uplift Approval Request

• User impact if declined: If declined, QA cannot switch the Remote Settings client to the STAGE server, making it impossible to review changes on STAGE (including nimbus experiments, etc.)
• Is this code covered by automated tests?: No
• Has the fix been verified in Nightly?: Yes
• Needs manual test from QE?: Yes
• If yes, steps to reproduce: - install Remote Settings Devtools

• run Firefox with MOZ_REMOTE_SETTINGS_DEVTOOLS=1
• switch server to STAGE using devtools
• sync data successfully

• List of other uplifts needed: None
• Risk to taking this patch: Low
• Why is the change risky/not risky? (and alternatives if risky): Risk is low since it can only be executed by QA
• String changes made/needed:
• Is Android affected?: Yes

Comment 5

[Dianna Smith [:diannaS]]

Comment on attachment 9355090 [details]
Bug 1855221 - Fix stage server detection for trusted root hash r?jteow

Approved for 119.0b3

Comment 6

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-beta/rev/8935dc8b137f

Comment 7

[Bogdan Maris, Desktop Test Engineering]

Reproduced the invalid signature error using old Nightly (2023-09-25) build with remote settings 1.8.1.
Verified that using latest Remote Settings version 1.8.1, latest Nightly 120.0a1 from today and Firefox Beta build 119 from treeherder (https://treeherder.mozilla.org/jobs?repo=mozilla-beta&revision=1a41a118193dc3ad19c04b3da34ba9f08b5f4b2e) across platforms (Windows 10, macOS 13 and Ubuntu 22.04) the invalid signature error is no longer thrown.

Comment 8

[Pascal Chevrel:pascalc]

Comment on attachment 9355090 [details]
Bug 1855221 - Fix stage server detection for trusted root hash r?jteow

Approved for our next 118 dot release, thanks.

Comment 9

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-release/rev/c02f6baddba0

Comment 10

[Pascal Chevrel:pascalc]

https://hg.mozilla.org/releases/mozilla-release/rev/c02f6baddba0

Comment 11

[Bogdan Maris, Desktop Test Engineering]

(In reply to Bogdan Maris, Desktop QA from comment #7)

Reproduced the invalid signature error using old Nightly (2023-09-25) build with remote settings 1.8.1.
Verified that using latest Remote Settings version 1.8.1, latest Nightly 120.0a1 from today and Firefox Beta build 119 from treeherder (https://treeherder.mozilla.org/jobs?repo=mozilla-beta&revision=1a41a118193dc3ad19c04b3da34ba9f08b5f4b2e) across platforms (Windows 10, macOS 13 and Ubuntu 22.04) the invalid signature error is no longer thrown.

Also verified as fixed using Firefox 118.0.2 across platforms (Windows 10, macOS 13 and Ubuntu 22.04).

Comment 12

[Mathieu Leplatre [:leplatrem]]

Thank you everyone! I'm sorry for the overhead work