582347 - infrastructure/automation for signing official Mozilla add-ons

Status: RESOLVED FIXED

(Release Engineering :: Release Automation: Other, defect, P3)

Description

[Justin Scott [:fligtar]]

This bug is spun off from an email thread started in May 2009 and picked back up as a request in March. We'd like to start signing add-ons that are made by Mozilla and hopefully those by Labs as well.

After Release Engineering gets the cert and sets it up, hopefully we can get a couple other folks set up to sign add-ons so that frequent add-on releases don't become a huge deal.

Some work has already been started trying to obtain a cert for this though I'm unsure of the current status. I'd really to be able to start signing this quarter as it's something we should have been doing long ago.

Thanks!

Comment 1

[Justin Scott [:fligtar]]

Hi,

Any updates on this?

Comment 2

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

fligtar:

Found during triage. Its been a while. Is this still needed, and if so, can you give a quick summary on what you're looking for nowadays, in case things have changed since mid2010?

Comment 3

[Justin Scott [:fligtar]]

It's still needed and nothing's changed: we'd like to sign the add-ons we build internally with a cert that says Mozilla.

Comment 4

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

(In reply to comment #3)
> It's still needed and nothing's changed: we'd like to sign the add-ons we build
> internally with a cert that says Mozilla.

ok. would you be doing the signing? would you expect to send new Addons to RelEng for signing? (if all these questions are in an email thread, can you reforward it to me?).

I'm trying to figure out whats involved here.

Comment 5

[Justin Scott [:fligtar]]

Given the frequency of Labs releases, I think it would probably be ideal if a person in Labs could sign their add-ons (Mardak perhaps?) and I could sign the non-Labs official add-ons.

Comment 6

[Ed Lee :Mardak]

There was some discussion about getting a code signing cert for automatic add-on installs with Lab Kit (bug 600036). Then, it was decided that there was little benefit for the added overhead; and an alternate way of securing Lab Kit add-on installs was available.

Some concerns involved who would have access. What's the process of getting something signed? What scope should a signing cert be used for (any labs add-on?) What to do about revocation, etc?

fligtar: Do you know any plans of future Firefox add-on install process regarding displaying signed/unsigned add-ons differently?

Comment 7

[[e-mail] (:bhearsum)]

From a mechanical standpoint, we might be able to use the signing server developer in bug 509158 to do this.

Comment 8

[LegNeato]

FWIW we are planning to do this manually for the hotfix certs in bug 707207. This bug can track future generalized / automated infrastructure.

Comment 9

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

found in triage. 

1) I'm not working on this, and wont be soon, given other several higher priority projects on my plate, so removing myself from this. Also, moving to correct component, in case anyone else has time. 

2) Not sure of urgency/priority of this. From the last comment in this bug, ~12 months ago, legneato confirmed doing signing manually, and morphing this bug into non-blocking, more general improvement bug. If situation has changed, and this lack-of-automation is blocking, please provide details.

Comment 10

[[e-mail] (:bhearsum)]

I keep coming across this bug in triage and thinking "but we're *already* able to sign add-ons". Updating the summary for clarity.

Comment 11

[Dave Townsend [:mossop]]

(In reply to Ben Hearsum [:bhearsum] from comment #10)
> I keep coming across this bug in triage and thinking "but we're *already*
> able to sign add-ons". Updating the summary for clarity.

Is there actually anything worth keeping around for this bug? Are we ok with the status quo of signing hotfixes? We can't sign any other add-ons as we don't have certs for them but presumably if we did they we could just sign them in the same way as hotfixes.

Comment 12

[[e-mail] (:bhearsum)]

I think it's worthwhile to keep open. I'd like to see better automation around this as well as integration with our signing servers, but it's certainly not a high priority right now.

Comment 13

[[e-mail] (:bhearsum)]

I think AMO went and did this themselves...