Closed Bug 1895483 Opened 10 months ago Closed 8 months ago

set up windows watersheds for 2024 authenticode certificate renewal

Categories

(Release Engineering :: Release Automation, task)

Product:
Release Engineering
Component:
Release Automation
Type:
task

Tracking

(firefox-esr115 fixed, firefox126 unaffected, firefox127 fixed, firefox128 fixed)

Status:
RESOLVED FIXED
Tracking Flags:
Tracking Status
firefox-esr115 --- fixed
firefox126 --- unaffected
firefox127 --- fixed
firefox128 --- fixed

People

(Reporter: jcristau, Assigned: jcristau)

References

Details

We need to set up a watershed on each channel to ensure users get a build with the change from bug 1894689 before updating to a build signed with the new authenticode cert from bug 1889299.

Summary: set up windows watersheds for → set up windows watersheds for 2024 authenticode certificate renewal

This is now in place for nightly*:

$ curl -s https://aus-api.mozilla.org/api/v1/rules/17900 | jq .
{
  "rule_id": 17900,
  "alias": null,
  "priority": 160,
  "mapping": "Firefox-mozilla-central-nightly-20240512212637",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": null,
  "channel": "nightly*",
  "buildTarget": null,
  "buildID": "<20240503220029",
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - nightly watershed for authenticode issuer change",
  "data_version": 3
}
Assignee: nobody → jcristau
Status: NEW → ASSIGNED

Bug 1889299 was backed out, so the rule referenced in comment 1 was removed for now.

Depends on: 1896944
Depends on: 1898762

The certificate switch re-landed, and the watershed on nightly is back:

$ curl -s https://aus-api.mozilla.org/api/v1/rules/17902 | jq . 
{
  "rule_id": 17902,
  "alias": null,
  "priority": 160,
  "mapping": "Firefox-mozilla-central-nightly-20240527092611",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": null,
  "channel": "nightly*",
  "buildTarget": null,
  "buildID": "<20240525094144",
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - nightly watershed for authenticode issuer change",
  "data_version": 2
}
status-firefox126: --- → unaffected
status-firefox127: --- → affected
status-firefox128: --- → fixed
status-firefox-esr115: --- → affected

Watersheds are in place on aurora and beta:

$ curl -s https://aus-api.mozilla.org/api/v1/rules/17926 | jq . 
{
  "rule_id": 17926,
  "alias": null,
  "priority": 180,
  "mapping": "Devedition-127.0b9-build1",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": "<128.0",
  "channel": "aurora*",
  "buildTarget": null,
  "buildID": "<20240529091551",
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - aurora watershed for authenticode issuer change\nBuilds before 127.0b8 go through 127.0b9",
  "data_version": 2
}
$ curl -s https://aus-api.mozilla.org/api/v1/rules/17927 | jq . 
{
  "rule_id": 17927,
  "alias": null,
  "priority": 85,
  "mapping": "Firefox-127.0-build2",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": "<128.0",
  "channel": "beta*",
  "buildTarget": null,
  "buildID": "<20240529091551",
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - beta watershed for authenticode issuer change\nBuilds before 127.0b8 go through 127.0-build2",
  "data_version": 3
}

Watershed on esr:

$ curl -s https://aus-api.mozilla.org/api/v1/rules/17931 | jq .
{
  "rule_id": 17931,
  "alias": null,
  "priority": 95,
  "mapping": "Firefox-115.12.0esr-build1",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": "<115.12",
  "channel": "esr*",
  "buildTarget": null,
  "buildID": null,
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - esr watershed for authenticode issuer change",
  "data_version": 1
}
status-firefox-esr115: affected → fixed

Now on release:

$ curl -s https://aus-api.mozilla.org/api/v1/rules/17933 | jq .
{
  "rule_id": 17933,
  "alias": null,
  "priority": 700,
  "mapping": "Firefox-127.0-build2",
  "fallbackMapping": null,
  "backgroundRate": 100,
  "update_type": "minor",
  "product": "Firefox",
  "version": "<127.0",
  "channel": "release*",
  "buildTarget": null,
  "buildID": null,
  "locale": null,
  "osVersion": "Windows_NT",
  "memory": null,
  "instructionSet": null,
  "jaws": null,
  "mig64": null,
  "distribution": null,
  "distVersion": null,
  "headerArchitecture": null,
  "comment": "Bug 1895483 - release watershed for authenticode issuer change",
  "data_version": 1
}
Status: ASSIGNED → RESOLVED
Closed: 8 months ago
status-firefox127: affected → fixed
Resolution: --- → FIXED
Component: Release Automation: Updates → Release Automation
You need to log in before you can comment on or make changes to this bug.