Closed Bug 1885457 Opened 2 months ago Closed 2 months ago

Sign test addon with "cas_cur" cert in support of CA Succession

Categories

(Release Engineering :: Release Requests, task)

Product:
Release Engineering
Component:
Release Requests
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: hwine, Assigned: jcristau)

References

Details

Attachments

(2 files)

tomato-clock.zip - source XPI file
433.28 KB, application/zip
Details
[mozilla-releng/adhoc-signing] Bug 1885457 - sign tomato-clock.xpi with autograph_xpi_sha1_es256_es384 format (#204)
56 bytes, text/x-github-pull-request
Details | Review

Using the certs from bug 1882192, sign the to-be-provided tomato-clock.zip extension in the to-be-specified flavors.

This bug is created based on information in a slack thread which turned out to be insufficient to perform the signing. The unknowns include:

  • where is the file to be signed? Please attach to this bug. (Per this script there is a single input file.)
  • What are the flavors of signing needed? Note:
    • in the autograph world, flavors are expressed via addon manifests and choice-of-signer
    • in the old script the flavors are expressed via command line arguments

(Ideally, a description of the mapping between autograph use cases (production) and the test environment needs (add-on internals) could be provided, so autograph documentation can be updated.)

Flags: needinfo?(wdurand)
Flags: needinfo?(rob)

The test case doesn't really care about the contents, as long as it is a signed zip file. Take any of the zip files from https://hg.mozilla.org/mozilla-central/rev/8551b871802d remove the META-INF directory inside the zip file and use that as the input file.

I am not sure about what you mean by "flavor", but I will try to answer what I think that you are asking.

The xpi signer should be used: https://github.com/mozilla-services/autograph/tree/c890e14de5b04dcff9be0d07fdea4ae6bbb58557/signer/xpi

The test from the commit above tries to verify that the cert works with different algorithms. The end of the file names show the relevant algorithms to try. I see those referenced at https://github.com/mozilla-services/autograph/blob/c890e14de5b04dcff9be0d07fdea4ae6bbb58557/signer/xpi/cose.go#L30

Flags: needinfo?(rob)
Depends on: 1885493

My understanding is that the script mentioned in Comment 0 (which I also mentioned elsewhere) will generate all the signed ZIP files we need (and potentially more): https://github.com/mozilla-services/autograph/blob/c890e14de5b04dcff9be0d07fdea4ae6bbb58557/tools/autograph-client/build_test_xpis.sh.

As Rob pointed out in Comment 1, the source file doesn't really matter and it looks like we chose "tomato-clock" in the past, which might or might not be related to this add-on on AMO. I think Rob's suggesting to take one of the signed XPIs in tree and repackaging it without the signature files (to essentially rebuild a source file) should be good enough. I am going to attach a source ZIP file to this bug.

I am not really sure what the "flavors" are but we should use cas_cur_webextensions_rsa as signer ID.

Flags: needinfo?(wdurand)
Group: mozilla-employee-confidential
Component: Operations: Autograph → Release Requests
Product: Cloud Services → Release Engineering
QA Contact: jcristau
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: