661264 - repack is returning the wrong secret key

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Add-on Builder, defect)

Description

[Jeff Balogh (:jbalogh)]

https://github.com/mozilla/FlightDeck/blob/master/apps/repackage/tasks.py#L80 should be AMO_SECRET_KEY to match https://github.com/mozilla/FlightDeck/blob/master/apps/repackage/views.py#L68.

Comment 1

[Piotr Zalewa [:zalun]]

There are 2 keys
AMO_SECRET_KEY which is a proof for Builder the request came from AMO
and BUILDER_SECRET_KEY which is a proof for AMO the request came from Builder

Comment 2

[Jeff Balogh (:jbalogh)]

(In reply to comment #1)
> There are 2 keys
> AMO_SECRET_KEY which is a proof for Builder the request came from AMO
> and BUILDER_SECRET_KEY which is a proof for AMO the request came from Builder

It's easier if we maintain a single secret.

Comment 3

[Wil Clouser [:clouserw]]

(In reply to comment #2)
> (In reply to comment #1)
> > There are 2 keys
> > AMO_SECRET_KEY which is a proof for Builder the request came from AMO
> > and BUILDER_SECRET_KEY which is a proof for AMO the request came from Builder
> 
> It's easier if we maintain a single secret.

Having them separate is fine - If they are separate compromising one doesn't compromise both.  I thought I saw a patch about this earlier today - is this bug closed or being worked on?

Comment 4

[Piotr Zalewa [:zalun]]

Closed, it's easy to back if needed