1968561 - Switch Mac signing to new M2 Mac signers

Status: VERIFIED FIXED

(Release Engineering :: General, task, P2)

Comment 1

[Heitor Neiva [:hneiva]]

Attachment: Bug 1968561 - Switch Mac signing to new M2 Mac Signer pool r?#releng

Comment 2

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/97f05637a92e
Switch Mac signing to new M2 Mac Signer pool r=releng-reviewers,ahal

Comment 3

[Sandor Molnar[:smolnar]]

https://hg.mozilla.org/mozilla-central/rev/97f05637a92e

Comment 4

[BMO Github Automation]

Attachment: [mozilla-releng/fxci-config] Bug 1968561 - Add dep signing scope to level 3 gecko/tb projects (#404)

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/mozilla-central/rev/9944947d9b28
Revert "Bug 1968561 - Switch Mac signing to new M2 Mac Signer pool r=releng-reviewers,ahal" missing scopes for central/main and causing the decision task to fail

Comment 6

[Sandor Molnar[:smolnar]]

Backed out for missing scopes for central/main and causing the decision task to fail

Backout link: https://hg.mozilla.org/mozilla-central/rev/9944947d9b28311bb247894425f91b984eecbf3b

Comment 7

[BMO Github Automation]

Authored by https://github.com/hneiva
https://github.com/mozilla-releng/fxci-config/commit/3cd02282ba44da2b8c96a2b9ed1abd5a92b8db93
[main] Bug 1968561 - Add dep signing scope to level 3 gecko/tb projects (#404)

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/37089ba72498
Switch Mac signing to new M2 Mac Signer pool r=releng-reviewers,ahal

Comment 9

[Atila Butkovits]

https://hg.mozilla.org/mozilla-central/rev/37089ba72498

Comment 10

[Heitor Neiva [:hneiva]]

Attachment: Bug 1968561 - Switch Mac signing to new M2 Mac Signer pool r?#releng

Original Revision: https://phabricator.services.mozilla.com/D251194

Comment 11

[Heitor Neiva [:hneiva]]

Attachment: Bug 1968561 - Switch Mac signing to new M2 Mac Signer pool r=#release-managers

Original Revision: https://phabricator.services.mozilla.com/D251194

Comment 12

[Heitor Neiva [:hneiva]]

Attachment: Bug 1968561 - Switch Mac signing to new M2 Mac Signer pool r=#releng-reviewers,ahal

Original Revision: https://phabricator.services.mozilla.com/D251194

Comment 13

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined: Eventually we won't be able to sign
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Make sure the browser launches in macos
• Risk associated with taking this patch: very low
• Explanation of risk level: changing signing host only
• String changes made/needed: No
• Is Android affected?: no

Comment 14

[Phabricator Automation]

firefox-esr128 Uplift Approval Request

• User impact if declined: Eventually we won't be able to sign
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Make sure the browser launches in macos
• Risk associated with taking this patch: very low
• Explanation of risk level: changing signing host only
• String changes made/needed: No
• Is Android affected?: no

Comment 15

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined: Eventually we won't be able to sign
• Code covered by automated testing: no
• Fix verified in Nightly: yes
• Needs manual QE test: no
• Steps to reproduce for manual QE testing: Make sure the browser launches in macos
• Risk associated with taking this patch: very low
• Explanation of risk level: changing signing host only
• String changes made/needed: No
• Is Android affected?: no

Comment 16

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/5407c2b13544

Comment 17

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/220507a7c260

Comment 18

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr128/rev/0296a7a11583

Comment 19

[Alexandru Trif, Desktop Test Engineering [:atrif]]

Hello! I have verified that Firefox 142.0a1 (2025-07-10), 141.0b8, 140.1.0esr (20250711093849), 128.13.0esr (from comment 18), and 115.26.0esr (from comment 17) open correctly on macOS 14 (M1 Pro, AArch64) and macOS 12 (Intel).

Note (this is only for treeherder builds):

• for 140.1.0esr (20250711093849), 128.13.0esr and 115.26.0esr on macOS 14 aarch I have used the treeherder builds from macOS AArch64 Shippable > Bpgo > B > target.dmg (e.g link) and I had to use xattr -cr /Apppath command because the builds were damaged and could not be opened.
• for 140.1.0esr (20250711093849), 128.13.0esr and 115.26.0esr on macOS 12 Intel, I have used the treeherder builds from macOS Shippable > Bpgo > B > target.dmg` (e.g. link)- here I didn't have to use the above command, but I had to open the Firefox app using double click first and then using r-click -> Open on the Firefox.app.

I will reverify 140.1.0esr, 128.13.0esr and 115.26.0esr with official builds again when they are available. Is the above verification enough, and are the Treeherder builds used correct? Do we also need to verify this on an M2 hardware? Thank you in advance!

Comment 20

[Julien Cristau [:jcristau]]

(In reply to Alexandru Trif, Desktop Test Engineering [:atrif] from comment #19)

Note (this is only for treeherder builds):

• for 140.1.0esr (20250711093849), 128.13.0esr and 115.26.0esr on macOS 14 aarch I have used the treeherder builds from macOS AArch64 Shippable > Bpgo > B > target.dmg (e.g link) and I had to use xattr -cr /Apppath command because the builds were damaged and could not be opened.
• for 140.1.0esr (20250711093849), 128.13.0esr and 115.26.0esr on macOS 12 Intel, I have used the treeherder builds from macOS Shippable > Bpgo > B > target.dmg` (e.g. link)- here I didn't have to use the above command, but I had to open the Firefox app using double click first and then using r-click -> Open on the Firefox.app.

These are unsigned, I believe you should use macOS Shippable > Rpk instead (for both intel and aarch64).

Comment 21

[Alexandru Trif, Desktop Test Engineering [:atrif]]

(In reply to Julien Cristau [:jcristau] from comment #20)

These are unsigned, I believe you should use macOS Shippable > Rpk instead (for both intel and aarch64).

Thank you, Julien, for your answer. I have also verified that the 140.1.0esr (20250711093849), 128.13.0esr, and 115.26.0esr treeherder builds are correctly opened using macOS Shippable > Rpk on both Intel macOS 12 and aarch macOS 14 on M1 Pro.

Comment 22

[Heitor Neiva [:hneiva]]

Thank you :atrif and :jcristau for helping verify this change!

Comment 23

[Alexandru Trif, Desktop Test Engineering [:atrif]]

No worries! Verified fixed with official builds: Firefox 141.0 (20250714153642), 141.1.0esr (20250714132824), 128.13.0esr (20250714124554), and 115.26.0esr (20250714124644). The .dmg and .pkg builds are correctly opened on macOS 12.7 Intel and macOS 14.7.1 aarch on Apple M1 Pro.