715623 - Load balance between signing servers

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Chris AtLee [:catlee]]

Attachment: implement --cache-dir for signtool

We're currently locked into using one signing server per build because of the way windows builds work. The basic problem here is that we run 'make package' followed by 'make installer'. Both targets copy the same original unsigned files to a staging directory, and then sign them. We're relying on server-side caching to make sure we get the same signcode signature given the same .dll/.exe. Having the same signature is important so that the binaries in the setup.exe, .zip, and .mar files are identical; otherwise partial updates won't apply cleanly.

One fix for this is to do local caching of signed files by unsigned file hash. This way a single build will only sign each unsigned file once, instead of possibly twice.

Comment 1

[Chris AtLee [:catlee]]

Attachment: pass --cachedir in MOZ_SIGN_CMD

Comment 2

[Rail Aliiev [:rail]]

Comment on attachment 586177 [details] [diff] [review]
implement --cache-dir for signtool

Review of attachment 586177 [details] [diff] [review]:
-----------------------------------------------------------------

::: release/signing/signing.py
@@ +474,5 @@
> +            os.rename(tmpfile, dest)
> +            log.info("%s: OK", filehash)
> +            # See if we should re-sign NSS
> +            if options.nsscmd and filehash != newhash and os.path.exists(os.path.splitext(filename)[0] + ".chk"):
> +                cmd = "%s %s" % (options.nsscmd, dest)

How about this?
cmd = '%s "%s"' % (options.nsscmd, dest)
It shouldn't be a problem, but...

Comment 3

[Chris AtLee [:catlee]]

Attachment: implement --cachedir for signtool (with quotes for nsscmd)

same as before, now with quotes in both places for nsscmd

Comment 4

[[e-mail] (:bhearsum)]

Chris, should this be assigned to you?

Comment 5

[Chris AtLee [:catlee]]

Rail turned on load balancing in secrets.pp; waiting for the next reconfig.

Comment 6

[Rail Aliiev [:rail]]

it works great!