730328 - Sign Thunderbird builds using auto-signing

Status: RESOLVED FIXED

(Release Engineering :: General, defect, P2)

Comment 1

[John Hopkins (:jhopkins)]

We want to sign Thunderbird using the same "auto-sign" instance and tools that Firefox uses.
We should have a required effort estimate next week and then we can shoot for a specific release to cut over.

Comment 2

[Rail Aliiev [:rail]]

Autosigning requires some other changes as well:

  * make sure if build system patches created for signing on demand work for Thunderbird
  * Automation should upload files to win32 instead of unsignied/win32
    ** What makes impossible to use FtpPoller to trigger updates
      *** Need to use l10n poller, or AggregatingScheduler
  * If you want to sign MAR files as well:
    ** Need to switch to ScriptFactory for l10n repacks

Anything else?

Comment 3

[Rail Aliiev [:rail]]

IMO this should be done as a part of porting Thunderbird release automation to the new procedure used by Firefox. I don't think that it's worth to spend time backporting it to the current Thunderbird release automation.

Back to the pool

Comment 4

[John Hopkins (:jhopkins)]

Thunderbird builds are now being manually signed using Firefox signing infra.

Comment 5

[Nomis101]

It seems for Mac OS X 10.8, we also need to developer-id-sign the Thunderbird Mac bundle (is now Bug 756830).

Comment 6

[Mark Banner (:standard8)]

Nomis101, please be careful about altering dependencies - bug 750461 is a tracking bug we're using for follow-up work, and this bug does depend on bug 755999 to be fixed before this will work, as per the comment in that bug.

Comment 7

[Mark Banner (:standard8)]

(In reply to Nomis101 from comment #5)
> It seems for Mac OS X 10.8, we also need to developer-id-sign the
> Thunderbird Mac bundle (is now Bug 756830).

Oh and whilst that's true, it isn't necessarily anything directly to do with this bug, but we can assess it when we do the work.

Comment 8

[Nomis101]

(In reply to Mark Banner (:standard8) from comment #6)
> Nomis101, please be careful about altering dependencies - bug 750461 is a
> tracking bug we're using for follow-up work, and this bug does depend on bug
> 755999 to be fixed before this will work, as per the comment in that bug.
Sorry, it was not my intent to alter any dependencies in this bug! If I've done so, this was accidentally (Bugzilla was a bit buggy to me yesderday). Sorry!

Comment 9

[[e-mail] (:bhearsum)]

This is essentially required for Mac signing - we need nightlies and aurora signed for them to function on OOB 10.8 installs. Raising priority.

Comment 10

[Rail Aliiev [:rail]]

Attachment: comm-central changes

Comment 11

[Rail Aliiev [:rail]]

Attachment: [WIP] Mac signing

Comment 12

[Rail Aliiev [:rail]]

Comment on attachment 626154 [details] [diff] [review]
[WIP] Mac signing

Mark, could you take a look at mail/app/macbuild/Contents/_CodeSignature/CodeResources, especially at entries with "omit". Should we add/remove other things here?

Comment 13

[Rail Aliiev [:rail]]

Comment on attachment 626121 [details] [diff] [review]
comm-central changes

The patch worked fine in staging.

buildbot-configs part incoming

Comment 14

[Rail Aliiev [:rail]]

Attachment: enable tb signing (no mac yet)

Comment 15

[Rail Aliiev [:rail]]

Probably we'll also need to disable updates on comm-central, use nightlytest channel to verify them, and enable nightly updates afterwards.

Comment 16

[Mark Banner (:standard8)]

Comment on attachment 626121 [details] [diff] [review]
comm-central changes

Do we need to be adding ac_add_options --enable-signmar to the mozconfigs as well?

Comment 17

[[e-mail] (:bhearsum)]

You don't need --enable-signmar. That's only included in the Firefox ones in order to make sure that binary still builds. Only the signing servers actually run it.

Comment 18

[Mark Banner (:standard8)]

Comment on attachment 626121 [details] [diff] [review]
comm-central changes

I moved this to bug 758328 for tracking purposes, it has now landed as well.

Comment 19

[Rail Aliiev [:rail]]

Attachment: upload snippets to comm-central-test

In case if we want to use nightlytest

Comment 20

[Rail Aliiev [:rail]]

Comment on attachment 626820 [details] [diff] [review]
enable tb signing (no mac yet)

http://hg.mozilla.org/build/buildbot-configs/rev/9bfdb7460ddc

Comment 21

[Rail Aliiev [:rail]]

Comment on attachment 627196 [details] [diff] [review]
upload snippets to comm-central-test

http://hg.mozilla.org/build/buildbot-configs/rev/780b3f90d30e

Comment 22

[Rail Aliiev [:rail]]

Comment on attachment 627196 [details] [diff] [review]
upload snippets to comm-central-test

http://hg.mozilla.org/build/buildbot-configs/rev/cbab683e89b9

Comment 23

[Rail Aliiev [:rail]]

Attachment: tools

comm-central should be a fork of mozilla-central! :)

Comment 24

[Rail Aliiev [:rail]]

Comment on attachment 627262 [details] [diff] [review]
tools

http://hg.mozilla.org/build/tools/rev/e03f1fcb9891

Comment 25

[Mark Banner (:standard8)]

Comment on attachment 627262 [details] [diff] [review]
tools

+    mozillaDir = ''
+    if 'thunderbird' in productName:
+        mozillaDir = 'mozilla/'

Note: Thunderbird does now have the mozilla_dir set in GLOBAL_VARS (the value is missing for Firefox).

Comment 26

[Mark Banner (:standard8)]

Comment on attachment 626154 [details] [diff] [review]
[WIP] Mac signing

AFAIK we don't actually have any different requirements to Firefox here. So can you refresh the patch with the latest changes and attach to bug 759114? Then we can sync up on what we want to do about landing etc.

Comment 27

[Rail Aliiev [:rail]]

Down to normal since almost everything is done.

Comment 28

[Rail Aliiev [:rail]]

All done here. We may want to use the corresponding configs to enable this feature for 13.0 and esr10 releases (already on track).

GPG/codesign comm-central changes ported to comm-esr10, comm-beta and will be migrated to comm-release channel for 13.0.

Mac signing comm-central changes ported to comm-beta and will be migrated to comm-release channel for 13.0.